Google Patches Zero-Click Pixel Modem Zero-Day CVE-2026-58704

Google's September 15 Pixel update fixes an actively exploited zero-click modem flaw, CVE-2026-58704, with CISA giving federal agencies just three days.

On September 15, 2026, Google released a Pixel update fixing CVE-2026-58704, a high-severity privilege escalation flaw (CVSS 8.0) in the phones' cellular modem. The bulletin carries a stark note: 'There are indications that CVE-2026-58704 may be under limited, targeted exploitation.' The bug is a permissions bypass caused by a logic error, and exploitation requires no user interaction at all — no link clicks, no file downloads. TechCrunch reports the attack could occur unnoticed and without any action from the phone's owner.

The modem is the component that talks to the cellular network, running its own firmware separate from Android — the baseband, in industry jargon. A bug there opens a door that apps and permissions do not guard. According to Pasquale Pillitteri's analysis, Google describes the attack surface as 'remote (proximal/adjacent)': the attacker must be near the phone or on the same network, not launching from a distant server. The flaw also lets an attacker escape the modem's isolated environment into the rest of the device, per ForkLog. TechRepublic, cited in the Pillitteri piece, notes that with the main OS now better defended, low-level modem firmware has become a fresh attack vector — and because this is a logic error, hardware defenses like MTE would not have stopped it.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 16 and gave US federal civilian agencies until September 19 to patch — a margin the Pillitteri analysis calls extremely tight for federal bureaucracy. The agency calls this class of vulnerability a frequent vector for malicious actors posing significant risks to federal networks. Google has not attributed the attacks to any group; TechCrunch notes such modem bugs are typically abused by spyware vendors selling surveillance tools to governments, though that remains reconstruction rather than confirmation.

The fix ships in security patch level 2026-09-05, and all supported Pixel models will receive it. Users should open Settings > Security & privacy > System & updates > Security update, install the September 2026 update, restart, and verify the patch level under Settings > About phone. Pixels that no longer receive security updates stay exposed, since the defect sits in the modem rather than an uninstallable app. The September bulletin fixes 110 vulnerabilities in total, and — per The Hacker News, cited by Pillitteri — 46 of them are rated critical, affecting components like the bootloader and trusted execution environment. GrapheneOS users should verify their build includes the September fix.