CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Google Pixel cellular-modem zero-click privilege escalation, exploited in limited targeted attacks, CISA KEV 2026-09-16

cve · CVE-2026-58704

Coverage
1
first 2026-09-17 → last 2026-09-30
Latest activity
2026-09-17
Google patches a Pixel modem zero-day that CISA lists as exploited, and TechCrunch reports Google as saying…
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector
Sources cited
4
3 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-58704, newest first. Check the date before acting on an older one.

  • Push the 2026-09-05 Pixel security patch level to every managed Pixel device today, prioritising devices issued to personnel who could plausibly be individually targeted by surveillance-grade exploitation (police, government officials, diplomatic staff).
    2026-09-17CVE-2026-58704

Defender insights

What each entry about CVE-2026-58704 tells a defender to do, newest first.

2026-09-17HIGHexploitedGoogle patches a Pixel modem zero-day that CISA lists as exploited, and TechCrunch reports Google as saying it may be under limited, targeted exploitation

Story timeline

  1. 2026-09-17CVE-2026-58704: Google Pixel zero-click privilege escalation out of the cellular modem sandbox, listed in CISA KEV as exploited
    trending-vulnerabilitiesGoogle patches a Pixel modem zero-day that CISA lists as exploited, and TechCrunch reports Google as saying it may be under limited, targeted exploitation

Hunting pivots

Affected products
Google Pixel
Tags
actively-exploitedcisa-kevmobilepriv-escvulnerabilitieszero-click
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Privilege EscalationExploitation for Privilege Escalation

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-09-17/cve-2026-58704-google-pixel-modem-zero-click-eop · ATT&CK page ↗

Entries about Google Pixel cellular-modem zero-click privilege escalation, exploited in limited targeted attacks, CISA KEV 2026-09-16 (1)

2026-09-17 · view entry permalink →

HIGHCVE-2026-58704exploitedupdatedNATOA1

CVE-2026-58704: Google Pixel zero-click privilege escalation out of the cellular modem sandbox, listed in CISA KEV as exploited

Google's September 2026 Pixel Update Bulletin fixes CVE-2026-58704 (bug A-484011314), a High-severity elevation-of-privilege flaw the bulletin classes as affecting the modem subcomponent (Google, 2026-09-15); CISA describes a logic error in the cellular modem that "may allow an attacker to bypass permission checks and escalate privileges" (CISA KEV catalog, 2026-09-16), and TechCrunch reports it can be exploited with no interaction from the phone owner, reaching beyond the modem's sandbox into the phone's data (TechCrunch, 2026-09-16). CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-09-16 (CISA, 2026-09-16; CISA KEV JSON feed, 2026-09-16). TechCrunch's summary quotes Google as saying there are indications the bug "may be under limited, targeted exploitation", while its opening sentence says Google says the bug "was exploited in limited and targeted cyberattacks" (TechCrunch, 2026-09-16). Google did not name a responsible actor, and a Google spokesperson did not return TechCrunch's request for comment (TechCrunch, 2026-09-16). All supported Pixel devices receive the fix at the 2026-09-05 security patch level.

Google says that a bug in its Pixel smartphones’ software was exploited in limited and targeted cyberattacks.

The Pixel phone maker said there are indications that a bug in the phone's modem "may be under limited, targeted exploitation."

The bug can be exploited silently and without any interaction from the phone owner in what’s known as a “zero-click” attack, meaning a victim does not need to click on a link or open a file.

TechCrunch 2026-09-16
Correctionrun 2026-09-30T0639Z-auditsourcessourcing_notebodytitleheadlinesummaryevidence

Google did not confirm exploitation to TechCrunch directly: a Google spokesperson did not return TechCrunch's request for comment. TechCrunch words Google's position two ways, as indications that the bug "may be under limited, targeted exploitation" in its summary and as a bug that "was exploited in limited and targeted cyberattacks" in its opening sentence (TechCrunch, 2026-09-16). CISA lists CVE-2026-58704 as a known exploited vulnerability (CISA KEV catalog, 2026-09-16).

vulnerability17 Sep 04:34Zmulti-sourceOpen finding →
Sources: Google (Pixel Update Bulletin) · TechCrunch · CISA (KEV addition alert) · CISA Known Exploited Vulnerabilities catalog (JSON feed)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cisa.gov2 (50%)
  • source.android.com1 (25%)
  • techcrunch.com1 (25%)

External references

NVD · cve.org · CISA KEV

All cited sources (4)