Google's Pixel Modem Zero-Day (CVE-2026-58704): A Proximity Threat That Needs No Tap
A logic error in the cellular modem lets an attacker in the same radio range escalate privileges with no user interaction. Google and CISA both confirm limited, targeted exploitation.
Google's September 2026 Pixel Update Bulletin (published September 15, 2026) fixed 110 vulnerabilities across supported Pixel devices, and one of them stands out. CVE-2026-58704 is a high-severity elevation-of-privilege flaw in the cellular modem component that Google flagged as possibly under limited, targeted exploitation in the wild.
The flaw is described in the bulletin as a A-484011314 entry: in cellular modem code, a logic error can bypass an intended permission check, leading to a remote (proximal/adjacent) escalation of privilege. Two properties make it unusual. First, no user interaction is required. Second, the attack needs to originate proximally or adjacent to the device rather than from anywhere on the open internet.
Why the modem layer is a hard target
The cellular modem is a CPM (code-processing module) that runs below the Android application sandbox. It operates on its own kernel and communicates over a low-level IPC channel with the rest of the software stack. A vulnerability here sits underneath the protections that catch most app-layer bugs: no app sandbox boundary to contain it, and a privilege boundary to cross upward.
CVSS-style analysis of the publicly available data describes the attack vector as adjacent network, low attack complexity, no user interaction, and high impact to confidentiality, integrity, and availability. In practice, an attacker in the same radio range — a phone in a crowded venue, a bus with a target nearby, a meeting in an office — can probe the modem radio and trigger the permission bypass without the owner ever touching the screen.
What CISA and Google are saying
CISA added CVE-2026-58704 to its Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026, alongside federal guidance to apply mitigations in line with BOD 26-04 (Prioritizing Security Updates Based on Risk). CISA's note explicitly calls for the federal enterprise to patch quickly and to perform forensics triage per its guidance.
Google told BleepingComputer: "There are indications that CVE-2026-58704 may be under limited, targeted exploitation". Google did not share a model-by-model affected-device table or an exact earliest-exploitation timestamp, but confirmed that all supported Google Pixel devices received security patch level 2026-09-05 in the September Pixel Bulletin.
If you own a Pixel (or a device from an OEM that tracks Google's Pixel Update Bulletin), confirm your security patch level is 2026-09-05 or later. If you operate an MDM fleet, treat the modem fix as a high-priority update for devices that sit in shared venues — the attack vector assumes physical proximity and low starting privileges, so your first line of defense is patch currency on the modem, not app-layer controls. If you are a high-value target (journalist, executive, field operator), consider the radio environment itself as an attack surface: a nearby device can be a carrier for an exploit payload.
Where this fits
This is the third actively exploited Android zero-day in the 2026 cycle (after the Qualcomm CVE-2026-21385 in March and the June framework flaw CVE-2025-48595), but it is the first to sit in the modem rather than the framework or kernel. For analysts tracking the trend, the pattern is consistent with what Pradeo and other researchers flagged in mid-2026: the gap between a zero-day being reported to a vendor and a patch reaching end users keeps growing, and the attack surface keeps shifting from the OS layer down into the radios, the chipsets, and the firmware. The practical guidance the industry keeps repeating is to treat waiting for the update as a risk to manage, not a risk to wait out.
Sources: Google Pixel Update Bulletin, September 2026; CISA KEV catalog, CVE-2026-58704 entry; BleepingComputer, Google fixes actively exploited Android zero-day on Pixel devices.
Corrections: Report an error at corrections@wireshaman.com.