Google has released its September 2026 security update for Pixel devices, fixing a large number of security vulnerabilities, including a high severity zero day that may already be under attack. The vulnerability is tracked as CVE-2026-58704 and affects the cellular modem component used by supported Pixel devices. Google said there are indications that the flaw may be under limited and targeted exploitation. The company has not shared details about who may have been targeted or how the attacks were carried out. However, the warning makes this update particularly important for Pixel users who have not yet installed the latest security patch.
According to Google’s security bulletin, CVE-2026-58704 is an elevation of privilege vulnerability caused by a permission bypass due to a logic error in the cellular modem code. The flaw can potentially allow an attacker in a nearby or adjacent network position to gain higher privileges on the affected device. Google also confirmed that exploitation does not require any interaction from the victim. The vulnerability does not require additional execution privileges either, making the issue more concerning because an attacker may be able to abuse the modem without first convincing the user to open a file, install an application or click a link.
The September Pixel security update does not only address this zero day. Google’s bulletin contains fixes for many other security problems affecting different parts of Pixel devices, including the modem, bootloader, telephony components, trusted execution environment, fingerprint systems, graphics components and other hardware related areas. Several vulnerabilities are rated critical or high severity, including remote code execution and privilege escalation issues. Google said that supported devices receiving the 2026-09-05 security patch level will have the issues covered by the Pixel bulletin and the September Android security bulletin addressed.
Google has not publicly released technical details that could explain exactly how CVE-2026-58704 was used in the reported attacks. The Android bug connected with the vulnerability is also not publicly available. This limits what security researchers and users currently know about the attack method and the exact capabilities an attacker could obtain after successful exploitation. Google has only described the issue as a permission bypass in the cellular modem that can result in remote escalation of privilege from a nearby or adjacent network position. More information may become available later as the update reaches more devices and security researchers analyse the fix.
For Pixel users, the main step is to install the September security update as soon as it becomes available on the device. Google says the 2026-09-05 security patch level addresses the vulnerabilities listed in the September Pixel bulletin. Users can check their security update through the device’s Settings menu under Security and privacy, followed by System and updates and Security update. After installing the update, the device should show the September 5, 2026 security patch level or a later one. Keeping the phone updated is especially important when a vulnerability has indications of active or targeted exploitation.
The latest Pixel security release shows why modem and hardware related vulnerabilities can be especially important for smartphone security. Unlike ordinary application bugs, modem vulnerabilities affect components responsible for cellular communication and can expose attack surfaces that users may not directly interact with. Google has now released fixes for CVE-2026-58704 along with many other Pixel security issues, but the company has provided only limited information about the attacks. For now, Pixel owners should check their security patch level and install the September 2026 update if it has not already been applied.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
