Google Patches a Pixel Modem Bug That Needed No Tap to Exploit

Google's September 2026 Pixel Update Bulletin discloses a modem vulnerability that needs no tap, download or other action from the phone's owner to exploit, and says the flaw "may be under limited, targeted exploitation." That is the same phrase Google has used in the past for zero-days later tied to commercial spyware, though the bulletin itself names no attacker and no victim.

The flaw, CVE-2026-58704, is a high-severity issue in the modem subcomponent, according to the bulletin published by the Android Open Source Project. Google describes it as a permission-check bypass reachable by a nearby attacker with only basic device privileges, with no additional execution rights and no user interaction required to trigger it.

What the September bulletin actually fixes

Security patch levels of 2026-09-05 or later remove CVE-2026-58704 along with every other issue in the bulletin, which Google's own count puts at roughly 140 vulnerabilities spanning the kernel, Pixel-specific components and related drivers. Seven of those are rated critical remote-code-execution bugs; close to 90 more are privilege-escalation issues, according to BleepingComputer, which reviewed the same bulletin. All supported Pixel devices, spanning the Pixel 6 series through the Pixel 11 family, are receiving the update.

Bulletin figure	Count
Total vulnerabilities patched	~140
Critical remote-code-execution bugs	7
Privilege-escalation bugs	~90
Actively exploited zero-days disclosed	1

What Google will not say

Google's bulletin does not name the modem vendor whose code contains the flaw, does not say how many devices were targeted before the patch, and does not credit a researcher or security firm with finding it. That is a narrower disclosure than Google gave for its own Gemini breach, where the company eventually detailed a specific incident timeline; here, the entire public record is a single reference number, A-484011314, in Google's internal tracker.

CVE-2026-58704 follows CVE-2025-48595, an Android Framework zero-day Google confirmed was actively exploited in June 2026, a reminder that Pixel-specific hardware, not just the shared Android framework, has now produced its own run of in-the-wild bugs. CISA has added CVE-2026-58704 to its Known Exploited Vulnerabilities catalog, which obligates federal agencies to patch but sets no deadline for the ordinary consumers who own most Pixel phones.

Why a modem bug outranks an app bug

A flaw confined to an app is bounded by whatever permissions that app already holds. A modem flaw sits underneath the operating system, in code that processes radio signals before any app-level permission check runs, which is why researchers who track spyware vendors watch baseband bugs more closely than most other categories: a working exploit there can survive a factory reset, since baseband firmware is not part of what a reset clears. Google's own severity rubric still calls CVE-2026-58704 high rather than critical, a distinction the bulletin does not explain.

The same pattern of a vendor disclosing only the minimum required detail shows up in the mismatched severity scores CISA assigned a batch of Linux kernel flaws this month, where the public record was also thinner than the underlying risk. Google has not said whether the "limited, targeted" exploitation it describes has ended, or whether the attacker who used CVE-2026-58704 before Sept. 5 is still active on unpatched phones today.