Google patches critical Pixel modem security vulnerability

Google has released a patch to address a critical security vulnerability, identified as CVE-2026-58704, affecting the cellular modem in supported Pixel devices. The flaw is a logic error within the modem code that allows an attacker from an adjacent network or radio environment to bypass permission checks and escalate privileges on the device.

The vulnerability has a CVSS score of 8.8. According to Google, there are indications that the flaw is being used in “limited and targeted attacks.” The Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its catalog of actively exploited vulnerabilities on September 16, 2026, setting a deadline for countermeasures by September 19, 2026.