INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Google Pixel Modem Exploit Patched

| 2026-09-16 10:39 CRITICAL HIGH EXPLOITED VULNERABILITY VULNERABILITY DISCLOSURE
JSON
Executive Summary
AI-generated
The recent exploitation of a high-severity zero-day vulnerability in Google's Pixel cellular modem has sparked widespread concern among cybersecurity experts and organizations managing large fleets of devices. This critical issue, identified as CVE-2026-58704, poses significant risks to the security and integrity of mobile networks worldwide. As a result, timely patching is crucial for mitigating potential exploitation and preventing targeted attacks. Google's official Pixel bulletin has listed multiple critical-severity vulnerabilities affecting various components, including the kernel, modem, bootloader, telephony stack, Trusted Execution Environment, GPU, Bluetooth, NFC, pKVM, and several proprietary Pixel components. The vulnerability was found to be exploited in limited, targeted attacks, emphasizing the need for swift action from affected organizations to ensure the security of their devices and networks.
Technical Mitigations AI-generated
* Use a secure and up-to-date Android version, such as Android 11 or later, to minimize the risk of exploitation. * Regularly update your device's operating system and other software components to ensure you have the latest security patches. * Be cautious when connecting to public Wi-Fi networks, as they may not be secure. Consider using a VPN (Virtual Private Network) instead. * Use strong passwords and enable two-factor authentication whenever possible to prevent unauthorized access to your device or data. * Keep your device's operating system and other software components up-to-date with the latest security patches, including any recommended updates from Google.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2025-48595CVE-2025-48595 CVE-2026-58704CVE-2026-58704
Target & Sectors
Global Scope manufacturingmanufacturing
Incident Timeline
‎September 5, 2026
Google urges its Pixel phone owners to update their devices due to an actively exploited modem flaw.
infrastructure Android
After updating, check that the Android security update level shows September 5, 2026 , or later.
While Android users should always install the latest update offered by their device manufacturer, this particular zero-day appears in the Pixel-specific bulletin.
Google’s Pixel phones use hardware and software components that other Android manufacturers do not necessarily share, including the affected modem component.
If you have another Android brand, you won’t receive this specific Pixel fix, but you should still check for your manufacturer’s latest monthly security update.
Download for iOS →   Download for Android →
organisation Malwarebytes Mobile Security
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more.
infrastructure Ios
Download for iOS →   Download for Android →
organisation Scam Guard
With real-time AI-powered Scam Guard built right in.
‎2026/09/05
Google Pixel owners are advised to update their devices due to an actively exploited modem flaw.
‎September 16, 2026
Google has patched a high-severity zero-day in the Pixel cellular modem.
organisation Google
Google Patches Pixel Modem Zero-Day Exploited in Targeted Attacks Pierluigi Paganini September 16, 2026 Google has patched a high-severity zero-day in the Pixel cellular modem after finding evidence that the vulnerability was exploited in limited, targeted attacks.
‎2026/09/16
Google Pixel owners are advised to patch a recently discovered vulnerability in their cellular modems.
‎2026/09/16
Google's official Pixel bulletin warns that a high-severity security flaw in the modem subcomponent has been actively exploited, posing a risk to device and network communications.
infrastructure Android
Unlike vulnerabilities affecting applications or higher-level Android components, CVE-2026-58704 resides in the cellular modem, a security-sensitive component responsible for communications between the device and mobile networks.
Modem vulnerabilities have historically attracted attention because they can operate below much of the Android application security model.
The broader September Android security bulletin also addresses additional vulnerabilities across the Android platform.
Google fixes actively exploited Android zero-day on Pixel devices.
Although Google Pixel devices also run Android, they receive separate security updates and bug fixes from the standard monthly patches distributed to Android OEMs because of the unique hardware platform Google controls directly and its exclusive features and capabilities.
In June, Google also addressed an Android Framework zero-day flaw (CVE-2025-48595) that was actively exploited in targeted attacks and could let attackers gain code execution and escalate privileges on devices running Android 14 or later.
One month earlier, the company announced an overhaul of its Android and Chrome vulnerability rewards programs, scaling back payouts for flaws that are easier to find using artificial intelligence (AI) while offering bounties of up to $1.5 million for some Android exploits.
organisation modem
Modem vulnerabilities have historically attracted attention because they can operate below much of the Android application security model.
Google Pixel owners urged to patch actively exploited modem flaw.
Google’s official Pixel bulletin lists additional security issues affecting components including the kernel, modem, bootloader, telephony stack, Trusted Execution Environment, GPU, Bluetooth, NFC, pKVM and several proprietary Pixel components.
" This high-severity security flaw stems from improper authorization and protection mechanism failure weaknesses affecting the Modem subcomponent.
organisation Pixel
Google fixes actively exploited Android zero-day on Pixel devices.
organisation Google Pixel
Although Google Pixel devices also run Android, they receive separate security updates and bug fixes from the standard monthly patches distributed to Android OEMs because of the unique hardware platform Google controls directly and its exclusive features and capabilities.
organisation CVE-2026
“There are indications that CVE-2026-58704 may be under limited, targeted exploitation.” states Google .
organisation CVE-2026-58704
CVE-2026-58704 is only one of many vulnerabilities addressed by Google’s September Pixel release.
organisation Trusted Execution Environment
Google’s official Pixel bulletin lists additional security issues affecting components including the kernel, modem, bootloader, telephony stack, Trusted Execution Environment, GPU, Bluetooth, NFC, pKVM and several proprietary Pixel components.
organisation GPU
Google’s official Pixel bulletin lists additional security issues affecting components including the kernel, modem, bootloader, telephony stack, Trusted Execution Environment, GPU, Bluetooth, NFC, pKVM and several proprietary Pixel components.
organisation NFC
Google’s official Pixel bulletin lists additional security issues affecting components including the kernel, modem, bootloader, telephony stack, Trusted Execution Environment, GPU, Bluetooth, NFC, pKVM and several proprietary Pixel components.
organisation IP Multimedia Subsystem
The bulletin includes multiple critical-severity vulnerabilities, including remote-code-execution flaws affecting the IP Multimedia Subsystem, libpixelimsmedia, VPU, modem, telephone and BigOcean components.
organisation libpixelimsmedia
The bulletin includes multiple critical-severity vulnerabilities, including remote-code-execution flaws affecting the IP Multimedia Subsystem, libpixelimsmedia, VPU, modem, telephone and BigOcean components.
organisation VPU
The bulletin includes multiple critical-severity vulnerabilities, including remote-code-execution flaws affecting the IP Multimedia Subsystem, libpixelimsmedia, VPU, modem, telephone and BigOcean components.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Pixel Modem)
organisation > System &
To apply this month's security updates, Pixel users must go to Settings > Security & privacy > System & updates > Security update, tap Install, and restart their devices to complete the update process.
organisation Install
To apply this month's security updates, Pixel users must go to Settings > Security & privacy > System & updates > Security update, tap Install, and restart their devices to complete the update process.
organisation NFL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation CHANEL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
‎September 2026
Google has released its September 2026 Pixel security update to address a high-severity flaw in the cellular modem.
organisation Google
Google has released its September 2026 Pixel Update Bulletin , fixing 110 vulnerabilities, including one that it says “may be under limited, targeted exploitation.”
Google has released the September 2026 security patches to address 110 vulnerabilities affecting its Pixel devices, including one zero-day flaw actively exploited in targeted attacks.
organisation Pixel Update Bulletin
Google has released its September 2026 Pixel Update Bulletin , fixing 110 vulnerabilities, including one that it says “may be under limited, targeted exploitation.”
general_metric 110 vulnerabilities
Google has released its September 2026 Pixel Update Bulletin , fixing 110 vulnerabilities, including one that it says “may be under limited, targeted exploitation.”
Google has released the September 2026 security patches to address 110 vulnerabilities affecting its Pixel devices, including one zero-day flaw actively exploited in targeted attacks.
vulnerability CVE-2026-58704
Google has released its September 2026 Pixel security update, addressing a large set of vulnerabilities, including a high-severity flaw, tracked as CVE-2026-58704 (CVSS score of 8.0), in the cellular modem that has already been exploited in the wild.
vulnerability CVSS score of 8.0
Google has released its September 2026 Pixel security update, addressing a large set of vulnerabilities, including a high-severity flaw, tracked as CVE-2026-58704 (CVSS score of 8.0), in the cellular modem that has already been exploited in the wild.
infrastructure 8.0
Google has released its September 2026 Pixel security update, addressing a large set of vulnerabilities, including a high-severity flaw, tracked as CVE-2026-58704 (CVSS score of 8.0), in the cellular modem that has already been exploited in the wild.
infrastructure Android
Although Pixel devices also run Android, they receive separate security updates and bug fixes from the standard monthly patches distributed to Android manufacturers because of the unique hardware platform Google controls directly and its exclusive features and capabilities.
organisation Pixel
Although Pixel devices also run Android, they receive separate security updates and bug fixes from the standard monthly patches distributed to Android manufacturers because of the unique hardware platform Google controls directly and its exclusive features and capabilities.
‎2026-09
Google urged Pixel device owners to patch an actively exploited modem flaw.
infrastructure Android
Google states that devices using the 2026-09-05 security patch level or later are protected against the issues covered by the Pixel bulletin and the September Android Security Bulletin.
The 2026-09-05 security patch level addresses the vulnerabilities listed in the September Pixel bulletin as well as those covered by the Android security bulletin.
organisation the September Android Security Bulletin
Google states that devices using the 2026-09-05 security patch level or later are protected against the issues covered by the Pixel bulletin and the September Android Security Bulletin.
Tactical Metrics
Metrics
infrastructure
‎Android
Affected Product
Although Pixel devices also run Android, they receive separate security updates and bug fixes from the standard monthly patches distributed to Android manufacturers because of the unique hardware platform Google controls directly and its exclusive features and capabilities.
After updating, check that the Android security update level shows September 5, 2026 , or later.
While Android users should always install the latest update offered by their device manufacturer, this particular zero-day appears in the Pixel-specific bulletin.
Google’s Pixel phones use hardware and software components that other Android manufacturers do not necessarily share, including the affected modem component.
If you have another Android brand, you won’t receive this specific Pixel fix, but you should still check for your manufacturer’s latest monthly security update.
Download for iOS →   Download for Android →
Unlike vulnerabilities affecting applications or higher-level Android components, CVE-2026-58704 resides in the cellular modem, a security-sensitive component responsible for communications between the device and mobile networks.
Modem vulnerabilities have historically attracted attention because they can operate below much of the Android application security model.
The broader September Android security bulletin also addresses additional vulnerabilities across the Android platform.
Google states that devices using the 2026-09-05 security patch level or later are protected against the issues covered by the Pixel bulletin and the September Android Security Bulletin.
The 2026-09-05 security patch level addresses the vulnerabilities listed in the September Pixel bulletin as well as those covered by the Android security bulletin.
Google fixes actively exploited Android zero-day on Pixel devices.
Although Google Pixel devices also run Android, they receive separate security updates and bug fixes from the standard monthly patches distributed to Android OEMs because of the unique hardware platform Google controls directly and its exclusive features and capabilities.
In June, Google also addressed an Android Framework zero-day flaw (CVE-2025-48595) that was actively exploited in targeted attacks and could let attackers gain code execution and escalate privileges on devices running Android 14 or later.
One month earlier, the company announced an overhaul of its Android and Chrome vulnerability rewards programs, scaling back payouts for flaws that are easier to find using artificial intelligence (AI) while offering bounties of up to $1.5 million for some Android exploits.
Metrics
infrastructure
‎Ios
Affected Product
Download for iOS →   Download for Android →
Metrics
infrastructure
‎8.0
Software Version
Google has released its September 2026 Pixel security update, addressing a large set of vulnerabilities, including a high-severity flaw, tracked as CVE-2026-58704 (CVSS score of 8.0), in the cellular modem that has already been exploited in the wild.
Intelligence Sources
Security Affairs 2026-09-16
Malware Bytes 2026-09-16
BleepingComputer 2026-09-16