CVE-2026-58704: Google Pixel Modem — Remote Privilege Escalation Risk (September 2026)

CVE-2026-58704 — Google Pixel Modem

CVE-2026-58704 is a high-severity vulnerability affecting the cellular modem in Google Pixel devices. This flaw is under active, targeted exploitation and allows an attacker with existing device access to escalate privileges remotely, without user interaction. No CVSS score is published, but Google classifies the risk as high and recommends immediate action.

Attack Vector

Exploitation requires the attacker to have a prior foothold on the device and access to an adjacent network (such as the same Wi-Fi or cellular segment). Once these conditions are met, the attacker can leverage the modem vulnerability to escalate privileges remotely, potentially gaining control over sensitive device functions. There are no public indicators of compromise, but network traffic from compromised devices may show anomalous modem activity or privilege escalation attempts.

Who Is at Risk

All Google Pixel devices with unpatched firmware are vulnerable. The risk is highest for users in targeted environments or those exposed to advanced threat actors capable of gaining initial access. Google is the confirmed affected organization, but the global user base of Pixel devices is at risk until patched.

Patch & Mitigate

• Patch: Apply the September 2026 Pixel security update immediately. This update addresses CVE-2026-58704 and 109 other vulnerabilities.
• Workaround: No effective workaround is available. Only patching mitigates the risk.
• Detect: Monitor device logs for unusual modem activity, privilege escalation attempts, or unexpected network connections originating from the modem process.

MITRE ATT&CK

• TA0004 — Privilege Escalation: The attacker leverages the modem flaw to gain higher privileges on the device.
• TA0003 — Persistence: Gained privileges may be used to maintain long-term access on compromised Pixel devices.

Source: https://www.malwarebytes.com/blog/mobile/2026/09/google-pixel-owners-urged-to-patch-actively-exploited-modem-flaw