Google Patches Pixel Modem Privilege Escalation Flaw (CVE-2026-58704)

Google has released a patch for a high‑severity privilege escalation flaw in the Pixel Cellular Modem (CVE‑2026‑58704, CVSS 8.0). The bug allows an attacker to bypass permission checks in the modem firmware without user interaction, potentially giving them local or remote privilege escalation on the device. The vulnerability has been observed in limited, targeted attacks, and the U.S. CISA has listed it as a known exploited vulnerability.

Impact

• Privilege escalation on Pixel devices with affected firmware.
• Potential for remote code execution if combined with other flaws.
• No user action required to exploit.

Mitigation

• Apply the September 2026 security patch (build 2026‑09‑05 or later).
• Verify device build number via Settings > About phone > Build number.
• Force a full system update if automatic update is disabled.

Monitoring & Response

• Watch for anomalous modem activity or unexpected privilege escalation in logs.
• Check for known exploit signatures or payloads associated with CVE‑2026‑58704.
• Coordinate with Google support if suspicious activity persists after patching.