Cellular modem permission bypass gives attackers in radio range privilege escalation on Google Pixel (CVE-2026-58704)
Google shipped the fix in the September 2026 Pixel bulletin on 2026-09-15 and CISA added the CVE to KEV on 2026-09-16 on evidence of targeted exploitation; Pixel fleets left below the 2026-09-05 patch level stay open to a no-interaction modem-side compromise.
A logic error in the Pixel cellular modem lets an attacker on the adjacent (cellular) network bypass permission checks and escalate privileges without any user interaction, with full confidentiality, integrity and availability impact on the device. Google reports it has been used in limited targeted attacks.
Affected: Google Pixel devices with security patch level earlier than 2026-09-05
How to Test
On each Pixel, check the Android security patch level (Settings → About phone → Android version, per Google's 'Check and update your Android version' guidance); any device showing a patch level earlier than 2026-09-05 is affected. For managed fleets, pull the patch level from your MDM inventory. The published reports give no indicators of compromise for this flaw; treat unexplained modem/baseband crashes or reboots on unpatched high-risk users' devices as worth a forensic look.
How to Patch
Install the September 2026 Pixel update so the device reports security patch level 2026-09-05 or later (Settings → System → Software update); all supported Pixel devices receive this update. No vendor workaround is published for devices that cannot update.