Google patches zero-click Pixel modem vulnerability

Google has patched a high-severity, zero-click privilege escalation vulnerability in the Pixel cellular modem firmware, identified as CVE-2026-58704. The flaw is a logic error involving improper authorization that allows an attacker to bypass permission checks and escalate privileges without any user interaction.

Because the modem firmware operates beneath the operating system, a compromise at this layer can bypass standard security architectures, including kernel protections and application sandboxing. Google has indicated there are signs the flaw may be under limited, targeted exploitation.

The Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog on September 16, 2026, requiring federal civilian agencies to remediate the issue by September 19. The September 2026 Pixel Update Bulletin addressed 110 vulnerabilities, including four other modem-related CVEs involving remote code execution and denial-of-service flaws.