CVE-2026-58704 is an authorization bypass in the cellular-modem software on Google Pixel phones. This is not a bug in an app that a user installs: the modem is the phone component that communicates with cellular networks. Pixel devices are used by consumers as well as organisations that manage Android fleets, including retailers, manufacturers, financial-services firms, healthcare providers and government bodies.
Google describes the issue as a High-severity elevation-of-privilege flaw in its September Pixel bulletin. The public record rates it 8.8 under CVSS 3.1 and identifies the affected product broadly as Google Android, but that record’s “Android kernel” version description does not squarely explain the Pixel modem finding. It should not be read as evidence that every Android device or kernel version is exposed.
A logic error defeats modem authorization
The underlying failure is simple in concept, even if the implementation remains private: logic in the modem can allow permission checks to be bypassed. An attacker could then escalate privileges, gaining capabilities they should not have. The published description characterises the route as remote, proximal or adjacent: the attacker needs to be in the relevant nearby or network-adjacent position, not already executing code or holding privileges on the phone. No user interaction is required.
That distinction matters for mobile-device teams. A phishing prompt or a malicious application need not be part of the disclosed precondition, but neither Google nor CISA has explained the exact adjacent-network mechanism, the complete exploit chain, or which privileges exploitation ultimately yields on a compromised device. Google also has not named the modem supplier, affected codebase, precise Pixel models, vulnerable builds or modem firmware versions.
Exploitation is treated as active, but details are scarce
Google says there are indications of limited, targeted exploitation. CISA added CVE-2026-58704 to its Known Exploited Vulnerabilities data on September 16, 2026, treating exploitation as active and setting a September 19 remediation due date. The KEV entry also calls for forensic triage; ransomware-campaign use is listed as unknown.
No attacker, victim set, country, campaign, delivery method, indicators of compromise, or exploitation timeline has been publicly identified. Equally, no verifiable public proof of concept or exploit code has surfaced as of September 18, 2026; one public exploit tracker likewise indexes no public PoC. Claims that an exploit exists without identified public code should not be mistaken for a reproducible demonstration.
Patch managed Pixel fleets now
A fix is available through Pixel security patch level 2026-09-05 or later, delivered in the September 2026 Pixel update. Google says supported Google devices will receive that patch level, but does not publish a conventional fixed modem version. Its internally tracked issue, A-484011314, is not publicly available; Google indicates the fix is generally delivered in current binary Pixel drivers, so there is no trustworthy source patch or diff to inspect.
Inventory corporate and enrolled Pixel devices, push the 2026-09-05-or-later patch level, and verify installation rather than treating update availability as remediation. Prioritise phones used by staff with sensitive accounts or regular exposure to untrusted locations, then use the available fleet and incident processes for triage; there are no flaw-specific public detection instructions. SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs, which helps keep this kind of mobile exposure from disappearing between monthly update cycles.
