High CVE-2026-58704 — A Pixel cellular-modem flaw is under limited, targeted exploitation and needs no user interaction. How to check your Android security patch level and what non-Pixel Android owners should do.
Published 2026-10-08 · Last updated 2026-10-08
TL;DR: A logic error in the Pixel's cellular modem lets an attacker nearby, or on the cellular network side, bypass permission checks with no tap or click from you. Google says it may be under limited, targeted exploitation. Install the update with security patch level 2026-09-05 or later.
| CVE | CVE-2026-58704 |
|---|---|
| Component | Pixel cellular modem |
| Type | Permission bypass → elevation of privilege |
| Attack vector | Proximal/adjacent; no user interaction |
| Severity | High (Google) |
| Fixed in | Pixel security patch level 2026-09-05 (bulletin published 2026-09-15) |
| Exploited? | Yes, “limited, targeted exploitation”; CISA KEV 2026-09-16 |
Your phone’s modem is a separate computer that handles calls, SMS, and mobile data. It processes data from the cell network before Android sees any of it. A logic error in the Pixel modem lets an attacker skip permission checks and gain privileges they shouldn’t have.
“Proximal/adjacent” means the attacker has to be nearby or positioned on the radio side, for example with a fake cell tower (an IMSI catcher). That’s expensive, which is why exploitation so far is targeted. Because no user interaction is needed, a targeted person can’t avoid it by being careful about links.
Settings → About phone → Android version → Android security update. If the date is earlier than September 5, 2026, your Pixel is vulnerable.
All supported Pixel devices received the 2026-09-05 patch level. Pixels past their update-support window won’t get it. If yours is out of support, it’s time to replace it.
Business-owned phones: set a minimum patch level in your MDM (Intune, Google Endpoint Management, etc.) so out-of-date devices lose access to company email and data until they update.
This CVE is in Google’s Pixel bulletin, which covers Pixel-specific components. Samsung, Motorola, OnePlus, and others publish their own monthly bulletins and ship patches on their own schedule, often weeks behind Pixel. Check your phone’s security patch date and install whatever your manufacturer offers. A patch date more than two or three months old is a red flag on any Android phone.
If you’re a likely target, consider Android’s Advanced Protection mode, and turning off 2G (Settings → Network & internet → SIMs → Allow 2G). Fake-tower attacks often push phones down to 2G.
Desert Forge IT patches, monitors, and backs up servers and networks for Phoenix-area businesses. We track advisories like this one so you don’t have to. Get a free consult and we’ll tell you what you’re exposed to.