CVE-2026-58704

What is the Pixel cellular modem?

The cellular modem (baseband) in Google Pixel devices handles radio and telephony processing and runs in a privilege domain isolated from the Android application processor. Modem-level vulnerabilities are especially prized by commercial spyware vendors and state actors because they can enable over-the-air, zero-click compromise: an attacker within radio range, or operating a rogue base station, can reach the modem without the target ever tapping anything. Baseband bugs have historically been the entry point for some of the most sophisticated mobile-surveillance chains.

Overview

CVE-2026-58704 is an improper authorization vulnerability (CWE-285) in the Pixel cellular modem, rated CVSS 8.8 over an adjacent (radio-proximal) attack vector. A logic error lets an attacker bypass a permission check and escalate privilege out of the modem's sandbox. Google's September 2026 Pixel bulletin flagged it with language indicating limited, targeted exploitation, and CISA added it to KEV on 2026-09-16.

Why only Pixel, and probably not every Pixel

Google publishes two security bulletins each month. The main Android Security Bulletin covers AOSP and shared components that every Android maker inherits, so those flaws affect the whole ecosystem. The Pixel Update Bulletin covers parts specific to Pixel hardware: the bootloader, security chip, Pixel drivers, and the cellular modem firmware. CVE-2026-58704 is published in that second bulletin, under the Pixel section with subcomponent Modem (Google reference A-484011314), so it is scoped to Pixel by construction. Other makers are not affected by this entry because their phones run different modem firmware, most often Qualcomm's own baseband, and any comparable flaw in that code would be tracked under a separate advisory and CVE.

The scope is narrower than "all Pixel," even though the phrasing can suggest otherwise. The bulletin does not publish a per-CVE list of affected models; it only says that "all supported Google devices will receive an update to the 2026-09-05 patch level." That sentence is about how the fix is distributed, not about which devices actually contain the flaw. A baseband bug lives in the modem firmware a given Pixel ships, and Pixel generations have not all used the same modem: earlier Pixels used Qualcomm Snapdragon basebands, while the Tensor-era Pixels moved to a Samsung/Exynos-derived modem, and the newest generation's modem sourcing has reportedly shifted again. Because the vulnerable code is one specific modem firmware line, it is unlikely that every Pixel model is affected. Google simply patches the whole supported fleet rather than enumerating the exact vulnerable subset.

Affected Versions

A device is protected once it reports the 2026-09-05 (or later) Android security patch level under Settings. Treat any supported Pixel below that patch level as needing the update, without assuming every model contained the flaw.

Technical Details

The Android bulletin describes CVE-2026-58704 as a possible permission bypass due to a logic error in the cellular modem component, allowing escalation of privilege. Because the flaw is an authorization logic error rather than memory corruption, exploitation does not depend on defeating memory protections; the modem simply grants an action it should have denied. The CVSS vector is adjacent (AV:A), meaning the attacker needs radio-proximal access rather than arbitrary internet reachability, and no user interaction is required.

Attack characteristics:

• Authentication: none
• User interaction: none (consistent with a zero-click radio-path attack)
• Vector: adjacent, at the cellular radio layer
• Impact: privilege escalation out of the modem sandbox (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Discovery

Google's September 2026 Pixel bulletin flagged the vulnerability. Available reporting does not name an external reporter for this specific CVE.

Exploitation Context

The Android Security Bulletin states there are indications that CVE-2026-58704 may be under limited, targeted exploitation, the phrasing Google reserves for narrow, high-end activity. No threat actor is named. The combination of a modem-level, zero-click-capable flaw and "limited, targeted" language matches the pattern of commercial-spyware and state-sponsored operations, though no attribution has been confirmed and this remains inference rather than a stated finding. No public proof of concept has been reported.

Remediation

1. Install the September 2026 Pixel update immediately. Confirm the device reports Android security patch level 2026-09-05 or later under Settings, About phone, Android version.
2. Prioritize high-risk users. Journalists, activists, executives, and government personnel are the realistic targets of this class of exploitation and should update first; consider enabling Android's Advanced Protection features for them.
3. There is no configuration workaround. The fix is firmware-level; until a device is patched, the only mitigation is reducing exposure (for example, avoiding untrusted cellular environments), which is not a reliable defense.
4. Apply the full September bulletin, which also addresses several critical RCE issues in modem, telephony, and IMS components; do not treat this CVE in isolation.