Google patched a high-severity Pixel modem flaw today that it says may already be under limited, targeted exploitation. CVE-2026-58704 lets an attacker within radio range of a Pixel phone skip a permission check inside the baseband and grab elevated access, no tap, no download, no unlocked screen required.

  • CVE-2026-58704 is a high-severity elevation-of-privilege bug in the Modem subcomponent of Google's September 2026 Pixel Update Bulletin, published today with a 2026-09-05 patch level.
  • Google's own advisory language, "there are indications that CVE-2026-58704 may be under limited, targeted exploitation," is the strongest active-exploitation signal Google puts in a bulletin short of confirming a specific attack.
  • The flaw is a logic error, not a memory-corruption bug, so Google's recent Rust rewrite of parts of the Pixel modem would not have caught it.
  • Every supported Pixel model gets the fix in the same update; there is no separate opt-in patch for the modem component.
How the Pixel modem permission bypass in CVE-2026-58704 worksAn attacker within radio range sends a crafted signal to the modem, which skips a permission check due to a logic error and hands over elevated access, and the attack needs low complexity, basic device privileges, and zero user interaction. THE BYPASS CHAIN Attackerin radio rangeadjacent network Crafted signalbaseband messagelayer Permission checkskippedlogic error Elevatedmodem accessroot on baseband ATTACK REQUIREMENTS Low complexityno special skill Basic privilegesnot fully unauthenticated Zero interactionno tap, no click genztech.blog
Fig 1 The full chain from a nearby attacker to elevated modem access: no phishing, no malicious app, just proximity and a logic bug Google's own permission code should have caught.

What did Google actually fix?

CVE-2026-58704 sits in the Modem subcomponent of Pixel firmware. Google's advisory classifies it as an elevation-of-privilege issue and, per the CWE mapping in the bulletin, traces it to improper authorization combined with a protection-mechanism failure: in plain terms, code that is supposed to check whether a given process or signal is allowed to reach a privileged modem function, and doesn't, because of a logic mistake rather than a memory-safety bug. The fix ships in the 2026-09-05 patch level, bundled into the wider September Pixel Update Bulletin that BleepingComputer reported covers roughly 110 flaws overall, including a dozen remote-code-execution bugs and dozens more privilege-escalation issues rated critical or high. Google has not named who found CVE-2026-58704 or published a bounty amount, which is typical while an active-exploitation investigation is still open.

RelatedChrome 153 Patches Seventh Zero-Day of 2026, CVE-2026-87491

Why does Google think it's already being exploited?

Google's bulletins almost never say more than "may be under limited, targeted exploitation," and that phrasing is doing real work here. It means Google's own threat intelligence, likely Project Zero or the Android security team, has seen something specific enough to flag, probably a small number of real devices or a leaked exploit chain, without confirming a broad campaign. "Limited, targeted" is the language Google reaches for when the evidence points at a handful of victims rather than mass exploitation, the kind of language that shows up around spyware vendors and nation-state operators more often than smash-and-grab criminal campaigns. Google does not publish attribution in these bulletins, so there's no vendor or country named, but the phrasing alone is enough reason to patch immediately rather than wait for the next Play Protect cycle.

Why does a modem bug matter more than a typical app-layer bug?

The baseband processor that runs a phone's modem firmware is a separate, less-audited operating environment sitting underneath Android itself, with its own memory, its own code, and historically far less scrutiny than the OS most security research targets. A bug that reaches elevated privileges inside the modem doesn't need the user to open anything: the attack surface is radio signals, not app permissions, which is exactly why the CVSS-style requirements Google lists (adjacent network, low complexity, no user interaction) read the way they do. Google has been trying to close this gap for a while. In April, the Pixel team shipped a Rust-based DNS parser inside the Pixel 10 modem specifically to kill off memory-corruption bugs in that code path, following similar memory-safety work that started with Pixel 9. CVE-2026-58704 is a reminder of the limits of that strategy: it's a logic error in access control, not a buffer overflow or use-after-free, so a memory-safe rewrite of the parsing layer would not have stopped it. Modem security needs both memory safety and correct permission logic, and Google is still working through the second one.

Who's affected, and what should you do right now?

Every currently supported Pixel model is affected and gets the same fix in the September update carrying the 2026-09-05 security patch level. There's no separate advisory for older, unsupported Pixels, which by implication means they don't get this patch at all. The fix requires no special action beyond installing the update: open Settings, System, System update, and confirm the security patch level reads 2026-09-05 or later. Given Google's own "may be under limited, targeted exploitation" language, this is a same-day update, not a whenever-you-get-to-it one, especially for anyone whose threat model includes being a plausible target of targeted surveillance (journalists, activists, executives, government employees).

RelatedA Cisco Zero-Day Was Exploited for Two Months Before Anyone Knew

  1. Apr 13, 2026Google adds a Rust-based DNS parser to the Pixel 10 modem memory-safety hardening, not a logic-bug fix
  2. Sep 3, 2026CVE-2026-85046, actively exploited Chrome V8 zero-day, patched added to CISA KEV the next day
  3. Sep 8-9, 2026CVE-2026-87491, Chrome's seventh 2026 zero-day, patched V8 out-of-bounds write
  4. Sep 16, 2026CVE-2026-58704, Pixel modem permission bypass, patched Google flags limited, targeted exploitation
What to watch
  • Attribution. Google rarely names who's behind "limited, targeted" exploitation, but follow-up reporting from mobile security researchers sometimes surfaces the spyware vendor or campaign months later.
  • Whether Samsung Exynos-based Android phones share the flaw. Pixel and Samsung modems have overlapped on vulnerabilities before; watch whether Samsung's own September bulletin references a related CVE.
  • More logic-class modem bugs. If Google's threat intel keeps surfacing access-control bugs after a year of memory-safety investment, expect a second wave of hardening aimed specifically at permission and authorization code, not just memory.

Our take

The interesting part of this bulletin isn't the patch, it's what the patch reveals about where Pixel's modem security work still has gaps. Google has spent over a year publicly hardening baseband firmware against memory-corruption bugs, the class of flaw that produced the greatest hits of modem hacking history. CVE-2026-58704 got through anyway, because it's a permission bug, not a memory bug, and that's a category Rust rewrites don't touch. Combined with Google's own signal that real, if limited, exploitation may already be happening, this is one of those Pixel patches worth installing the day it lands rather than the week after.

Primary sources

Original analysis by GenZTech. Primary advisory: Pixel Update Bulletin, September 2026.