CVE-2026-58704: Google Pixel zero-click privilege escalation out of the cellular modem sandbox, listed in CISA KEV as exploited
Google patches a Pixel modem flaw it says may be under limited, targeted exploitation, and CISA lists it as exploited
Defender actions
- Push the 2026-09-05 Pixel security patch level to every managed Pixel device today, prioritising devices issued to personnel who could plausibly be individually targeted by surveillance-grade exploitation (police, government officials, diplomatic staff).
Analysis
Google's September 2026 Pixel Update Bulletin fixes CVE-2026-58704 (bug A-484011314), a High-severity elevation-of-privilege flaw the bulletin classes as affecting the modem subcomponent, and notes: "There are indications that CVE-2026-58704 may be under limited, targeted exploitation" (Google, 2026-09-15). CISA describes a logic error in the cellular modem that "may allow an attacker to bypass permission checks and escalate privileges" (CISA KEV catalog, 2026-09-16), and ENISA's EU Vulnerability Database record describes a remote (proximal/adjacent) escalation of privilege that needs no user interaction, rated CVSS 3.1 8.8 with an adjacent-network vector (ENISA EU Vulnerability Database, 2026-09-15). TechCrunch reports it can be exploited with no interaction from the phone owner, reaching beyond the modem's sandbox into the phone's data (TechCrunch, 2026-09-16). CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-09-16 (CISA, 2026-09-16; CISA KEV JSON feed, 2026-09-16). TechCrunch's opening sentence, that the bug "was exploited in limited and targeted cyberattacks", is stronger than Google's own wording (TechCrunch, 2026-09-16). All supported Pixel devices receive the fix at the 2026-09-05 security patch level.
Cited evidence
There are indications that CVE-2026-58704 may be under limited, targeted exploitation.
Google says that a bug in its Pixel smartphones’ software was exploited in limited and targeted cyberattacks.
The Pixel phone maker said there are indications that a bug in the phone's modem "may be under limited, targeted exploitation."
The bug can be exploited silently and without any interaction from the phone owner in what’s known as a “zero-click” attack, meaning a victim does not need to click on a link or open a file.
Updates2
Google's own bulletin carries the hedged wording: "There are indications that CVE-2026-58704 may be under limited, targeted exploitation" (Google, 2026-09-15). TechCrunch's opening sentence, that the bug "was exploited in limited and targeted cyberattacks", is stronger than Google's wording (TechCrunch, 2026-09-16). CISA lists CVE-2026-58704 as a known exploited vulnerability (CISA KEV catalog, 2026-09-16).
Google's bulletin itself carries the exploitation note: "There are indications that CVE-2026-58704 may be under limited, targeted exploitation" (Google, 2026-09-15). TechCrunch's opening sentence, that the bug "was exploited in limited and targeted cyberattacks", is stronger than Google's wording (TechCrunch, 2026-09-16). ENISA's EU Vulnerability Database record describes a remote (proximal/adjacent) escalation of privilege that needs no user interaction and rates it CVSS 3.1 8.8 with an adjacent-network vector (ENISA EU Vulnerability Database, 2026-09-15).
Sources5
Revision history
- Published 2026-09-17T0409Z-intel
- Correction 2026-09-30T0639Z-audit
The title, headline, summary and description had presented exploitation as confirmed by Google. Google's spokesperson did not respond to TechCrunch, and TechCrunch words Google's position both as possible limited, targeted exploitation and as confirmed exploitation. The exploitation wording is now attributed to TechCrunch's reporting and the inconsistency is stated, with CISA's KEV listing the only unhedged exploitation signal. The flaw description cites CISA's KEV record and TechCrunch, no third-party severity score is given, and the takeaway cites TechCrunch for its note on surveillance vendors.
Changed: sources sourcing_note body title headline summary evidence
- Improvement 2026-10-21T0800Z-audit
Google's own Pixel bulletin carries the hedged note that there are indications of limited, targeted exploitation, so the exploitation wording now cites Google directly and notes that TechCrunch's "was exploited" opening is stronger than Google's; the framing that Google did not confirm exploitation is dropped. ENISA's EU Vulnerability Database record adds a CVSS 3.1 score of 8.8 with an adjacent-network vector and describes the flaw as remote (proximal/adjacent); EPSS is recorded from FIRST.
Changed: body cves evidence headline sources sourcing_note summary
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.