Google Pixel

product · product:google-pixel

Coverage

first 2026-09-17 → last 2026-10-21

Latest activity

2026-09-17

Google patches a Pixel modem flaw it says may be under limited, targeted exploitation, and CISA lists it as…

Peak priority

high

1 high

Targets

public-sector

sectors: public-sector

Sources cited

4 hosts

Action items (1)

Do-now tasks recorded on the entries about Google Pixel, newest first. Check the date before acting on an older one.

Push the 2026-09-05 Pixel security patch level to every managed Pixel device today, prioritising devices issued to personnel who could plausibly be individually targeted by surveillance-grade exploitation (police, government officials, diplomatic staff).
2026-09-17CVE-2026-58704

Defender insights

What each entry about Google Pixel tells a defender to do, newest first.

2026-09-17HIGHexploitedGoogle patches a Pixel modem flaw it says may be under limited, targeted exploitation, and CISA lists it as exploited

Story timeline

2026-09-17CVE-2026-58704: Google Pixel zero-click privilege escalation out of the cellular modem sandbox, listed in CISA KEV as exploited
trending-vulnerabilitiesGoogle patches a Pixel modem flaw it says may be under limited, targeted exploitation, and CISA lists it as exploited

Hunting pivots

CVEs (exploited first)

CVE-2026-58704

Releases covered

Google Pixel

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-09-17/cve-2026-58704-google-pixel-modem-zero-click-eop · ATT&CK page ↗

Entries about Google Pixel (1)

2026-09-17 · view entry permalink →

HIGHCVE-2026-58704exploitedupdatedNATOA1

CVE-2026-58704: Google Pixel zero-click privilege escalation out of the cellular modem sandbox, listed in CISA KEV as exploited

Google's September 2026 Pixel Update Bulletin fixes CVE-2026-58704 (bug A-484011314), a High-severity elevation-of-privilege flaw the bulletin classes as affecting the modem subcomponent, and notes: "There are indications that CVE-2026-58704 may be under limited, targeted exploitation" (Google, 2026-09-15). CISA describes a logic error in the cellular modem that "may allow an attacker to bypass permission checks and escalate privileges" (CISA KEV catalog, 2026-09-16), and ENISA's EU Vulnerability Database record describes a remote (proximal/adjacent) escalation of privilege that needs no user interaction, rated CVSS 3.1 8.8 with an adjacent-network vector (ENISA EU Vulnerability Database, 2026-09-15). TechCrunch reports it can be exploited with no interaction from the phone owner, reaching beyond the modem's sandbox into the phone's data (TechCrunch, 2026-09-16). CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-09-16 (CISA, 2026-09-16; CISA KEV JSON feed, 2026-09-16). TechCrunch's opening sentence, that the bug "was exploited in limited and targeted cyberattacks", is stronger than Google's own wording (TechCrunch, 2026-09-16). All supported Pixel devices receive the fix at the 2026-09-05 security patch level.

There are indications that CVE-2026-58704 may be under limited, targeted exploitation.

Google (Pixel Update Bulletin) 2026-09-15

Google says that a bug in its Pixel smartphones’ software was exploited in limited and targeted cyberattacks.

The Pixel phone maker said there are indications that a bug in the phone's modem "may be under limited, targeted exploitation."

The bug can be exploited silently and without any interaction from the phone owner in what’s known as a “zero-click” attack, meaning a victim does not need to click on a link or open a file.

TechCrunch 2026-09-16

Correction30 Sep 2026 07:19 UTCrun 2026-09-30T0639Z-auditsourcessourcing_notebodytitleheadlinesummaryevidence

Google's own bulletin carries the hedged wording: "There are indications that CVE-2026-58704 may be under limited, targeted exploitation" (Google, 2026-09-15). TechCrunch's opening sentence, that the bug "was exploited in limited and targeted cyberattacks", is stronger than Google's wording (TechCrunch, 2026-09-16). CISA lists CVE-2026-58704 as a known exploited vulnerability (CISA KEV catalog, 2026-09-16).

Improvement21 Oct 2026 08:21 UTCrun 2026-10-21T0800Z-auditbodycvesevidenceheadlinesourcessourcing_notesummary

Google's bulletin itself carries the exploitation note: "There are indications that CVE-2026-58704 may be under limited, targeted exploitation" (Google, 2026-09-15). TechCrunch's opening sentence, that the bug "was exploited in limited and targeted cyberattacks", is stronger than Google's wording (TechCrunch, 2026-09-16). ENISA's EU Vulnerability Database record describes a remote (proximal/adjacent) escalation of privilege that needs no user interaction and rates it CVSS 3.1 8.8 with an adjacent-network vector (ENISA EU Vulnerability Database, 2026-09-15).

vulnerability17 Sep 04:34Zmulti-sourceOpen finding →

Sources: Google (Pixel Update Bulletin) · TechCrunch · CISA (KEV addition alert) · CISA Known Exploited Vulnerabilities catalog (JSON feed) · ENISA EU Vulnerability Database

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Google Pixel cellular-modem zero-click privilege escalation; Google: indications it may be under limited, targeted exploitation; CISA KEV 2026-09-16×1
cveCVE-2026-58704

Where this entity is cited

Vulns1

Source distribution

cisa.gov2 (40%)
euvd.enisa.europa.eu1 (20%)
source.android.com1 (20%)
techcrunch.com1 (20%)

All cited sources (5)