Google has disclosed that a high severity security vulnerability affecting its Pixel Cellular Modem has been addressed through its latest security updates after finding indications that the flaw may have been under limited targeted exploitation. The vulnerability, tracked as CVE-2026-58704 with a CVSS score of 8.0, is a privilege escalation issue that could allow unauthorized elevation of permissions through a logic error in the modem code. Google has not disclosed additional details about the potential exploitation activity, including information about the nature of the attacks or the parties involved.
According to the description listed in the NIST National Vulnerability Database (NVD), CVE-2026-58704 exists in the Cellular Modem component due to a possible permission bypass caused by a logic error. The vulnerability could allow remote escalation of privileges through a proximal or adjacent connection without requiring additional execution privileges or user interaction. This type of flaw can create security risks by allowing attackers to gain higher levels of access within a device environment, making timely security updates important for affected users.
In addition to addressing CVE-2026-58704, Google has resolved 109 other security vulnerabilities as part of the September 2026 Pixel updates. Among these issues, 88 vulnerabilities were related to privilege escalation, 10 involved information disclosure, nine affected remote code execution, and two were linked to denial of service (DoS) conditions. The update package also included fixes for two high severity privilege escalation vulnerabilities affecting Kernel components, identified as CVE-2026-56914 and CVE-2026-58773. Google also addressed 46 critical severity vulnerabilities across various Pixel components, including BigOcean, Bootloader, IP Multimedia Subsystem and Trusted Execution Environment, which could potentially result in privilege escalation or remote code execution.
Google has advised Pixel users to install security patch levels dated 2026-09-05 or later to receive fixes for the identified issues. Users can update their devices by accessing Settings followed by Security & privacy options and checking for available updates. Keeping devices updated remains an important security practice as smartphone platforms continue to rely on complex software and hardware components that require ongoing protection against newly discovered vulnerabilities. The latest Pixel security update follows previous security efforts by Google to address actively exploited vulnerabilities across its platforms. In June 2026, the company released patches for a high severity Android Framework vulnerability tracked as CVE-2025-48595 with a CVSS score of 8.4, which Google had identified as being actively exploited. The continued release of security updates highlights the importance of maintaining updated devices and applying vendor-provided patches to reduce exposure to potential security risks.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
