Pixel Modem Zero-Day Exploited in Targeted Attacks

Summary

Google has released patches for a zero-day vulnerability, CVE-2026-58704, affecting the modem component of Pixel phones. The flaw, rated high severity, allowed for remote privilege escalation with no user interaction required and has been observed in limited, targeted exploitation. While no specific threat actor has been identified, the nature of the attack suggests potential links to commercial spyware or state-sponsored actors.

Full text

Google on Tuesday informed Pixel phone owners that it has patched a zero-day vulnerability exploited in targeted attacks. The zero-day is tracked as CVE-2026-58704, and Google said it’s aware of “limited, targeted exploitation”. The vulnerability has been rated high severity and affects the Pixel’s modem component. “In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation,” reads the CVE record for CVE-2026-58704. Google has not attributed the exploitation to a specific threat actor, but the modem-level, zero-click nature of the flaw and the company’s ‘limited, targeted’ framing are hallmarks of past attacks linked to commercial spyware vendors or state-sponsored actors. The latest Pixel updates also include the most recent Android security patches. They also resolve more than 100 other vulnerabilities that are specific to Pixel devices.Advertisement. Scroll to continue reading. Nearly 50 vulnerabilities have critical severity, enabling remote code execution or privilege escalation. The critical flaws affect the multimedia subsystem, VPU, modem, telephone, bootloader, TEE, libpixelimsmedia, GDMC, GSA, GPCA, and other components. Most of the remaining vulnerabilities are high severity, and exploiting them can lead to remote code execution, privilege escalation, information disclosure, and denial of service (DoS). Related: Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews Related: How a $50,000 Exploit Chain Turned Bixby Against Samsung Phones Related: What’s Hiding in Your Mobile Apps? Lookout MSEC Aims to Find Out Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Texas Utility CenterPoint Energy Confirms Breach After Hacker Leaks DataOpenAI Investigates Report Linking AI Agents to RubyGems AttackMicrosoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety ConstraintsRoot RCE Zero-Day in Cisco Secure Email Gateway Under Active ExploitationTelus Warns Customers of Account BreachesTrezor Says 347,000 Users Received Phishing Emails After Brevo HackUkrainian Conti Ransomware Developer Sentenced to 4 Years in US PrisonAnthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion Latest News AIUC Raises $40 Million to Certify Enterprise AI AgentsUS, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance MalwareUnauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to TakeoverHackuity Raises $19 Million for AI-Powered Vulnerability Management280,000 Impacted by Premier Medical Group Data BreachChrome, Firefox Updates Patch 115 VulnerabilitiesAcronis Patches Exploited Vulnerability in cPanel Backup PluginEnterprises Warned of Attacks Exploiting WSO2 Vulnerability Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Building Continuous Authorization at Scale September 23, 2026 Explore what it takes to operationalize continuous authorization at scale, including the technical, organizational, and cultural changes required. Register People on the Moveincident.io has appointed Carlos Gonzalez-Cadenas as Chief Operating Officer.Ruben D. Chacon has joined ADM as Vice President and Global CISO.GDIT has appointed retired Maj. Gen. Ryan Heritage as Vice President, Full-Spectrum Cyber.More People On The MoveExpert Insights “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-58704

Entities