Vulnerabilities

Google's Pixel Update Bulletin for September 2026, published on September 15, fixes 110 vulnerabilities on Pixel devices. One of them, CVE-2026-58704 in the cellular modem, carries Google's note that it "may be under limited, targeted exploitation". CISA added it to its Known Exploited Vulnerabilities (KEV) catalog the next day, and US federal agencies had until September 19 to patch.

Every supported Pixel is affected, from the Pixel 6 series to the Pixel 11 family, plus Pixel Tablet and Pixel Fold. The fix is security patch level 2026-09-05 or later. If your organisation issues Pixels, or lets staff enrol their own, find out which ones are still below that level, starting with the people someone would pay to spy on.

What the modem is, and why a bug there matters

The modem, also called the baseband, is a separate processor inside the phone that runs the cellular radio. It finds and registers with cell towers and carries calls, SMS and mobile data. It runs its own firmware, apart from Android, and Android talks to it through a defined interface.

That position is what makes it attractive. The modem handles radio traffic before Android's protections, such as the app sandbox, permission checks and SELinux, ever see it. Security tools on the phone run as Android apps (MDM agents, mobile threat defence), so they cannot look inside the modem's firmware. And a modem bug can be reachable over the air, with nothing for the user to tap.

How the flaw works

Google describes CVE-2026-58704 as "a possible permission bypass due to a logic error in the code" that "could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed". No user interaction is required. Trackers classify it as CWE-285 (improper authorization) and CWE-693 (protection mechanism failure): a check that should decide whether a request is allowed decides wrongly, and the request runs with more privilege than it should.

"Adjacent" is a Common Vulnerability Scoring System (CVSS) term. The attacker cannot do this from anywhere on the internet and has to be on the same network segment as the target. For a cellular modem that most likely means radio range, for example a fake base station near the victim, but Google has not said which path was used. Most trackers score it 8.0 under CVSS 3.1 (vector AV:A/AC:L/PR:L/UI:N), which assumes the attacker already has low-level privileges. At least one vulnerability database lists 8.8 with no privileges required. Google rates it High, and has published no technical write-up or indicators of compromise.

What attackers are doing

Very little is public. Google has not said who was targeted, since when, or by whom. "Limited, targeted" is the phrase Google uses when a small number of chosen people were attacked, and several reports note that earlier modem-level, zero-click bugs described this way were linked to commercial spyware vendors or state-backed groups. Google has not linked this one to any group.

For a business, the likely reading is that a random device will not be hit. The phones that matter most are those of executives, legal and finance staff in sensitive deals, anyone travelling to places where they could be singled out, and administrators whose phones approve MFA prompts or open admin consoles.

What to do

Check a single phone

On the Pixel, open Settings, then Security & privacy, then System & updates, then Security update. The Android security update date must read September 5, 2026 or later. If it does not, tap Install and restart. The fix is not active until the phone restarts, so a phone with a downloaded but pending update is still exposed.

Get the fleet to 2026-09-05

Pull a report of security patch level for every Android device in your MDM, and sort Pixels below 2026-09-05 by owner. In Microsoft Intune, an Android Enterprise compliance policy has a Minimum security patch level setting (under Device Health or System Security, depending on the enrolment type) that takes a date in YYYY-MM-DD format; devices below it are marked noncompliant, and Conditional Access can then block them from work data. Other Android Enterprise MDMs report the same field.

Apply the 2026-09-05 rule to a Pixel-only device group. Set fleet-wide, it would also flag every Samsung or Motorola phone whose maker has not shipped a September build yet, and the resulting noise hides the Pixels you actually need to chase.

Start with the high-risk users named above. Call them rather than waiting for the update to land overnight.

If a phone cannot be patched today

Google offers no workaround. For people at real risk, Android's Advanced Protection is worth turning on now, and it is useful after patching too. On Android 16 and later it sits under Settings, Security & privacy, Other settings, Advanced Protection. It blocks connections to 2G networks, a weaker protocol that fake base stations have long used to downgrade phones. It also blocks app installs from unknown sources, blocks USB data while the screen is locked and turns on Memory Tagging Extension (MTE), a hardware feature that stops apps corrupting memory. Google has not said whether it blocks this particular exploit, so treat it as extra hardening, and still patch.

Non-Pixel Android devices

The Pixel bulletin covers Pixels only. The separate Android Security Bulletin for September, which SecurityWeek counts at 180 fixes across the 2026-09-01 and 2026-09-05 patch levels, covers the Android platform and chip vendor components that every maker receives. Google has not said whether other phones share the flawed modem code. Modem firmware on Samsung, Motorola and other brands comes through each maker's own update and bulletin, so check those vendors' September bulletins rather than assuming a 2026-09-05 patch level on a non-Pixel phone covers this bug.

Checking whether a phone was already hit

There is no reliable check. A modem compromise leaves little that Android can see, and Google has published no indicators. Unexplained modem crashes or repeated loss of cellular service before patching are weak signals, but record them. If a high-risk user's phone behaved oddly before patching, do not factory-reset it first: capture a bug report (Developer options, Take bug report), keep the device, and get a mobile forensics specialist to review it. A reset destroys the evidence and does nothing about an account the attacker may already have used from that phone, so also review that person's recent sign-ins and MFA approvals.

Put phones on the patch dashboard

Phones are often missing from the patch reporting that servers and laptops get, even though an executive's phone holds the same mail and chat as their laptop, plus the MFA approvals. Keep a standing minimum patch level rule per manufacturer and tighten it within a day of an exploited-bug notice like this one. The next time Google flags a bug, your MDM will already list which phones are exposed.

Our mobile penetration testing tests the Android and iOS apps your staff carry, the data they leave on the device and the APIs behind them, and our safeguarding and hardening work sets up the compliance rules and baselines that keep the fleet current. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: Google Pixel Update Bulletin, September 2026, Android Security Bulletin, September 2026, BleepingComputer, Malwarebytes, SecurityWeek on the Pixel zero-day, SecurityWeek on Android's 180 fixes, CISA KEV alert, Android Authority, SOC Prime, ThreatAft, Google Advanced Protection help, Microsoft Intune Android Enterprise compliance settings.