Google said on 15 September that a flaw in the cellular modem of its Pixel phones "may be under limited, targeted exploitation", and released a fix [1].
The US Cybersecurity and Infrastructure Security Agency added it to its catalogue of exploited vulnerabilities on 16 September, giving federal agencies until 19 September to act [2].
The flaw, CVE-2026-58704, is a logic error that lets an attacker nearby bypass permission checks and gain higher privileges, with no action needed from the user. It is scored 8.8 out of 10 [3].
What it covers
Supported Google Pixel phones. Security patch levels of 2026-09-05 or later fix it, and Google says all supported devices will receive that update [1].
The September bulletin fixes dozens of other Pixel flaws, including one rated critical in the phone's multimedia calling system [1].
The vulnerability record describes the attack as "remote (proximal/adjacent)": made from nearby, not from anywhere on the internet [3].
What it does not tell you
Who was attacked, by whom, or how many phones. Google says only that exploitation may be limited and targeted [1].
Whether other phones are affected. The bulletin covers Google's own devices [1].
Comments