Zerodayhub

TL;DR — A logic flaw in the cellular modem of Google Pixel devices, CVE-2026-58704, lets a radio-adjacent attacker bypass a permission check and escalate privileges with no user interaction at all — a true zero-click bug. Google flagged it as under limited, targeted exploitation, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 16 September 2026 with an unusually short three-day federal patch deadline of 19 September 2026. The score has some spread: NVD and Google’s bulletin rate it CVSS 8.8 (High) on an Adjacent vector, while some early press reported 8.0. The fix ships in the 2026-09-05 Pixel security patch level — if your Pixel is on it or later, you’re covered; if not, this is a same-day update.

What Is the Google Pixel Modem Flaw (CVE-2026-58704)?

Every smartphone runs two worlds side by side. There is the application processor — Android, your apps, the lock screen — and there is the cellular modem (the baseband), a separate processor that speaks to the mobile network and handles calls, texts and data. The modem is a notoriously juicy target: it processes untrusted signalling from whatever tower the phone is talking to, and it sits below the parts of the system users can see. CVE-2026-58704 is a flaw in that modem on Google Pixel devices — described by Google as a logic error that allows an attacker to bypass a permission check and escalate privileges.

Google disclosed the issue in its September 2026 Pixel Update Bulletin and marked it as possibly under limited, targeted exploitation — the same cautious phrasing the company uses when a bug is being abused against specific individuals rather than sprayed at everyone. Crucially, it is a zero-click vulnerability: there is no malicious link to click and no file to open. That combination — a modem bug, silent triggering, targeted use — is the fingerprint of the commercial surveillance trade, though at the time of writing Google has not attributed it to any named spyware vendor.

How the CVE-2026-58704 Exploit Works

In plain terms: the modem is supposed to check that a given request is allowed before acting on it. Because of a logic error, a specially-shaped request slips past that check, and the attacker ends up with more privilege than they should ever have been granted — all without the phone’s owner touching anything.

The technical shape, as far as it is public, comes from the CVSS vector and Google’s one-line summary. The weakness is classed as CWE-285 (Improper Authorization), sitting under CWE-693 (Protection Mechanism Failure) — a missing or defeatable permission check rather than a memory-corruption overflow. The vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H tells the rest of the story: the attack vector is Adjacent (AV:A), not fully remote over the internet — the attacker has to be radio-adjacent, i.e. within range of the target with a rogue or malicious cell (an IMSI-catcher-style setup) or otherwise on the same radio link. It needs no privileges (PR:N) and no user interaction (UI:N), and once triggered it fully compromises confidentiality, integrity and availability (C:H/I:H/A:H).

That Adjacent requirement is the single most important piece of nuance here, and it is easy to lose in a headline. This is not a bug that lets anyone on the internet reach out and own your phone. It is a bug that lets an attacker who can put a radio near you do so silently — which is exactly the operating model of targeted surveillance, and exactly why a 3-day KEV deadline is warranted despite the “only Adjacent” vector. ZeroDayHub is not publishing exploit detail; Google has deliberately kept the mechanism sparse while patches roll out, and the responsible action is to update.

# What defenders can actually do here (a modem bug gives few host-side signals)
- Confirm the device security patch level is 2026-09-05 or later (Settings → Security)
- For high-risk users: enable a hardened profile (e.g. Android Advanced Protection)
- Treat unexplained battery/heat, dropped-to-2G behaviour or rogue cells as suspicious
- Prefer Wi-Fi calling / mobile data off in hostile RF environments for at-risk targets
- Fleet: enforce minimum patch level via MDM; flag Pixels stuck below 2026-09-05

Impact Nuance: Zero-Click and Targeted, but Adjacent (8.8 vs 8.0)

Two things deserve straight talk rather than a scary round number. First, the score: Google’s bulletin and the NVD/CIRCL data record this as CVSS 8.8 (High), and that is the number to quote; some early press coverage listed 8.0, which is why you may see both. Either way it lands firmly in High, not Critical — the Adjacent vector caps it below the 9.8 you would see for an equivalent fully-remote flaw.

Second, the reach: “zero-click modem exploit” sounds apocalyptic, and for a specific person being deliberately targeted it genuinely is — no interaction, no trace, and the modem is a powerful place to land. But the exposure is bounded by proximity and by who is actually being targeted. This is not wormable, mass-exploitation malware; the realistic threat model is targeted surveillance of high-value individuals (journalists, dissidents, executives, officials), which is precisely why Google used its “limited, targeted” language and why the story matters even though the average Pixel owner is not the intended prey. Patch anyway — the fix is free, one tap, and closes the door regardless of who the door was built for.

A zero-click modem bug does not need you to make a mistake. It needs an attacker to get a radio near you — which is the whole business model of commercial spyware.

Active Exploitation of CVE-2026-58704

This is not a theoretical, patch-it-eventually bug. In the September 2026 Pixel Update Bulletin (16 September 2026), Google marked CVE-2026-58704 as being under limited, targeted exploitation — its standard signal that the flaw is being used in real attacks against specific people. The same day, CISA added it to the Known Exploited Vulnerabilities catalog and set a three-day remediation deadline of 19 September 2026 for US federal civilian agencies under its Binding Operational Directive — a compressed timeline reserved for the flaws it considers most pressing.

What is not confirmed is equally worth stating plainly. Google has not named a threat actor or spyware vendor, has not published the number of victims, and released very little technical detail — reputable outlets covering the disclosure (The Hacker News, The Register, TechRepublic) all note how sparse the public information is. The zero-click, targeted, modem-level pattern strongly resembles commercial surveillance tooling, but resemblance is not attribution, and ZeroDayHub is not going to put a vendor’s name to it without evidence. No public proof-of-concept exploit had been released at the time of writing.

Remediation & Mitigation: Patching the Pixel Modem Flaw

Update to the 2026-09-05 patch level (or later). The fix ships in Google’s September 2026 Pixel security update. On the device, go to Settings → Security & privacy → System & updates → Security update, install, and reboot. Then confirm under Settings → About phone → Android version that the Android security update reads 5 September 2026 or newer. If it does, you are patched against this flaw.

Because this is delivered as a standard monthly OTA, the main practical gaps are devices that are slow to receive it or fleets that lag on updates:

• Fleet / MDM: enforce a minimum security patch level of 2026-09-05 and flag or quarantine any Pixel still below it. Prioritise devices belonging to high-risk roles.
• High-risk individuals: if you may be a target of surveillance, turn on Android Advanced Protection and keep it on — it hardens several of the surfaces this class of attack relies on.
• While you wait for the update: there is no user-facing toggle that fixes the modem itself, but reducing time spent attached to untrusted/unknown cells (and being alert to forced 2G downgrades or rogue base stations) lowers the opportunity for a radio-adjacent attacker.

If you have concrete reason to believe a device was targeted — you are a plausible surveillance target and saw the tell-tale signs — treat the whole device as suspect: update immediately, and for the highest-risk cases consider a factory reset (or device replacement) plus rotation of credentials and sessions that the phone could reach. For most people, the honest guidance is simpler: install the September update, confirm the patch level, and move on.

Related ZeroDayHub Coverage

Zero-click and authorization-bypass flaws on the devices people carry and use every day are a recurring theme here — the bugs that need no mistake from the victim are the ones worth watching. See our coverage of the actively-exploited Google Chrome V8 zero-day (CVE-2026-85046), another client-side flaw abused in the wild against ordinary users, and the macOS Screen Sharing authentication bypass (CVE-2026-65400), a comparable “skip the permission check” failure on a mainstream endpoint. The through-line: whether it is a browser, a desktop OS or a phone’s modem, a broken authorization boundary is all an attacker needs.

Sources & Further Reading

• Google — Pixel Update Bulletin, September 2026 (CVE-2026-58704, cellular modem, patch level 2026-09-05, limited targeted exploitation)
• CIRCL / NVD data — CVE-2026-58704 (CVSS 8.8, vector AV:A/…/C:H/I:H/A:H, CWE-285 & CWE-693)
• NVD — CVE-2026-58704 detail record
• The Hacker News — Google patches Pixel modem flaw amid signs of limited targeted exploitation
• The Register — Google Pixel phones pwned in zero-click attacks
• TechRepublic — CISA gives agencies 3 days to patch exploited Pixel zero-day
• CISA — Known Exploited Vulnerabilities Catalog

ZeroDayHub reports on vulnerabilities for defensive purposes only. This article summarises publicly-documented facts and deliberately omits exploit detail while patching is in progress.