Google Patches Exploited Zero‑Day on Pixel Phones – 110 Bugs Fixed

Google’s latest Pixel security update hits the market on September 5, 2026, closing a total of 110 bugs, the most significant of which is CVE‑2026‑58704 – a zero‑day that was already in the wild. The flaw is tucked inside the modem sub‑component and can be triggered by an attacker who has basic access to a nearby network. No user action is required, and the attack can raise privileges to root level.

Key Details

• Zero‑day CVE‑2026‑58704 – Remote privilege escalation via a modem permission bypass.
• 12 remote code execution bugs and 89 privilege‑escalation flaws rated critical or high.
• All supported Pixel devices (Pixel 5, 6, 7, 8, 9, and their Pro variants) will receive the 2026‑09‑05 patch.
• Pixel phones get their own update stream, separate from the generic Android OTA releases.

To stay protected, simply go to Settings > Security & privacy > System & updates > Security update, tap Install, and reboot. The patch is delivered over‑the‑air and takes a few minutes to complete.

Google also reminded users that a separate Android Framework zero‑day (CVE‑2025‑48595) was exploited in the summer, which could grant code execution on Android 14 and newer. The company has tightened its vulnerability rewards program, scaling back payouts for AI‑easy bugs while offering up to $1.5 million for high‑impact Android exploits.

"All supported Google devices will receive an update to the 2026‑09‑05 patch level," the company warned. "We encourage all customers to accept these updates to their devices."

With the new patch in place, Pixel owners can breathe easier, but vigilance remains key. Keep an eye on Google’s security bulletins and install updates promptly to guard against evolving threats.