Advisory · CVE-2026-58704
Pixel modem flaw lets nearby attackers escalate privileges
A logic error in the Pixel cellular modem allows adjacent-network privilege escalation with no user interaction; the September 2026 patch level fixes it.
- Vendor
- Product
- Pixel
- Identifier / CWE
- CVE-2026-58704
CWE-285, CWE-693 - Action timing
- Oct 7, 2026
Explain it like I’m five
The phone's radio chip has a bouncer checking IDs against a broken list. Someone standing close enough can talk their way past and get the keys to the building.
- 01Proximity attacker
An attacker within adjacent network range of the device, such as via rogue cellular infrastructure, targets the modem.
- 02Logic error
A logic error in the cellular modem code bypasses permission checks that should block the operation.
- 03Privilege escalation
The bypass leads to privilege escalation on the device with no additional execution privileges needed.
- 04No interaction
No user interaction is required, so the device owner gets no warning.
What happened
CISA added CVE-2026-58704 to the Known Exploited Vulnerabilities catalog on September 16, 2026. The flaw is a permission bypass in the Pixel cellular modem caused by a logic error in the code. It can lead to remote escalation of privilege over an adjacent network with no additional execution privileges and no user interaction, and is scored CVSS 8.8.
Google’s Pixel Update Bulletin for September 2026 lists the vulnerability (elevation of privilege, High severity, modem component) and states that security patch level 2026-09-05 or later addresses all issues in the bulletin. Because the attack vector is adjacent rather than fully remote, exploitation plausibly involves proximity to the target, such as rogue cellular infrastructure, but the KEV listing indicates real-world exploitation is occurring.
What to do
- Update Pixel devices to the 2026-09-05 security patch level or later immediately.
- For managed fleets, push the update through your MDM/EMM and verify patch levels across the estate; prioritize devices used by high-risk personnel.
- Treat devices that cannot be updated (end-of-support models) as higher risk and consider replacement.
- Remind users that modem-level flaws need no clicks or taps, so “I didn’t install anything” is not evidence of safety.
Management note
Baseband vulnerabilities are the worst kind of mobile flaw: they sit below the operating system, need no user interaction, and are invisible to endpoint tooling. The adjacent-network requirement limits the attacker pool to those who can get radio-proximate, which includes anyone with a software-defined radio near your offices or your executives’ travel routes. Fleet patch latency is the only control you have, so measure it.