Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation

Google has released a security update addressing a high-severity vulnerability in the Pixel Cellular Modem that has been exploited in the wild. The flaw, tracked as CVE-2026-58704 with a CVSS score of 8.0, is a privilege escalation issue stemming from a logic error that allows a permission bypass.

According to the NIST National Vulnerability Database, the vulnerability resides in the Cellular Modem component of Pixel smartphones. An attacker exploiting this flaw could potentially escalate privileges, gaining elevated access to sensitive modem functions or data. Google's advisory indicates that exploitation has been observed, but the attacks appear to be limited and targeted, with no details on the attack chain or threat actor disclosed.

The patch is included in Google's September 2026 security update. While the exact affected Pixel models have not been fully enumerated, all Pixel smartphone users with the vulnerable modem firmware are at risk. Google has not provided specific mitigation steps beyond applying the update, but users should prioritize installing the latest security patch to protect against potential exploitation.

This incident highlights the ongoing risk posed by vulnerabilities in mobile baseband processors, which are often high-value targets due to their privileged access to device communications. Organizations and individuals using Pixel devices should treat this update as urgent, especially given confirmed in-the-wild exploitation.