Key Points
- Google patches CVE-2026-58704 zero-day actively exploited in targeted attacks on Pixel devices
- September 2026 security update addresses 110 vulnerabilities including 12 critical remote code execution flaws
- Modem subcomponent flaw allows privilege escalation from adjacent network without user interaction
Google has released emergency security patches for its Pixel smartphone range to fix a zero-day vulnerability, a security flaw that was unknown to the company at the time attackers began exploiting it, that is currently being used in targeted attacks against users.
The September 2026 security update addresses 110 vulnerabilities affecting Pixel devices, with the most severe being CVE-2026-58704, a high-severity flaw in the modem subcomponent that handles cellular connectivity. Google confirmed the vulnerability is under active exploitation.
“There are indications that CVE-2026-58704 may be under limited, targeted exploitation,” the company said in its security bulletin published on Wednesday (16 September). “All supported Google devices will receive an update to the 2026-09-05 patch level. We encourage all customers to accept these updates to their devices.”
Modem vulnerability
The vulnerability stems from improper authorisation and protection mechanism failures in the modem subcomponent, the hardware and software layer that manages a device’s connection to mobile networks. An attacker with access to an adjacent network, such as a compromised Wi-Fi hotspot or rogue cell tower, could exploit this flaw to gain elevated system privileges without requiring any action from the device owner.
“In Cellular Modem, there is a possible permission bypass due to a logic error in the code,” Google’s security advisory states. “This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed.”
Privilege escalation refers to an attack technique where a malicious actor gains higher-level permissions than they should have, potentially allowing them to access sensitive data, install malware or take control of the device. The low complexity of the attack, combined with the absence of any user interaction requirement, makes this vulnerability particularly concerning for security researchers.
Beyond the zero-day flaw, the September update addresses 109 additional security issues. Of these, 12 are rated critical for enabling remote code execution, which means an attacker could run malicious programmes on a victim’s device from a distance. A further 89 vulnerabilities relate to privilege escalation risks rated as high severity.
Update instructions
Pixel users should install the security update immediately to protect their devices. To apply the patches, users must navigate to Settings, then Security and Privacy, followed by System and Updates, and finally Security Update. After tapping Install, the device must be restarted to complete the update process.
Google Pixel devices receive security updates separately from other Android smartphones because Google controls the hardware directly and can push patches without waiting for third-party manufacturers to adapt them. This means Pixel users typically receive security fixes before owners of Samsung, OnePlus, Xiaomi or other Android devices.
The September 2026 update follows a pattern of increasingly sophisticated attacks targeting Android devices. In June, Google patched another Android Framework zero-day, tracked as CVE-2025-48595, that was being exploited in targeted attacks. That vulnerability allowed attackers to gain code execution and escalate privileges on devices running Android 14 or later versions.
By the numbers
Key figures from this story- 110
- total vulnerabilities patched in September 2026 update
- 12
- critical remote code execution flaws addressed
- $1.5 million
- maximum bounty for Android exploit discoveries
Google has also adjusted its approach to vulnerability research rewards. In May, the company announced changes to its Android and Chrome vulnerability rewards programmes, reducing payouts for security flaws that are easier to discover using artificial intelligence tools while increasing bounties for complex exploits. The revised programme offers up to $1.5 million for certain Android security vulnerabilities.
Security researchers recommend that all Pixel owners verify their devices have received the September patch by checking Settings, then About Phone, and confirming the security patch level shows 5 September 2026 or later.
Your Questions, Answered
What is the Google Pixel zero-day vulnerability CVE-2026-58704?
CVE-2026-58704 is a high-severity security flaw in the modem subcomponent of Google Pixel devices. It allows attackers with adjacent network access to escalate privileges without requiring user interaction. Google has confirmed it is being actively exploited in targeted attacks.
How do I update my Google Pixel to fix the September 2026 security vulnerability?
Navigate to Settings, then Security and Privacy, followed by System and Updates, and tap Security Update. Select Install and restart your device to complete the update. Verify the patch level shows 5 September 2026 or later.
How many vulnerabilities does the September 2026 Pixel security update fix?
The September 2026 security update addresses 110 vulnerabilities in total. This includes 12 critical remote code execution flaws, 89 high-severity privilege escalation vulnerabilities and the actively exploited zero-day CVE-2026-58704.
Why do Pixel devices receive security updates separately from other Android phones?
Google controls Pixel hardware directly, allowing the company to push security patches without waiting for third-party manufacturers to adapt them. This means Pixel users typically receive security fixes before owners of other Android devices.
