Google has released its September 2026 Pixel Update Bulletin, fixing 110 vulnerabilities, including one that it says “may be under limited, targeted exploitation.”
The bug is not described as a simple remote takeover, but as a vulnerability that could give an attacker who already has a foothold on a phone more power than they should have.
Although Pixel devices also run Android, they receive separate security updates and bug fixes from the standard monthly patches distributed to Android manufacturers because of the unique hardware platform Google controls directly and its exclusive features and capabilities.
To apply this month’s security updates, Pixel users should go to Settings > Security & privacy > System & updates > Security update, tap Install, and restart their device to complete the update process.
A supported device with the 2026-09-05 patch level is up to date. After updating, check that the Android security update level shows September 5, 2026, or later.
Technical details
Google says it there are indications that the vulnerability, tracked as CVE-2026-58704, may be under limited, targeted exploitation. Found in the cellular modem, it is a possible permission bypass caused by a logic error in the code. This could lead to remote escalation of privilege (EoP) with no additional execution privileges or user interaction needed.
The vulnerability affects the modem component of Pixel devices and is rated high severity. The modem is the part of a smartphone that handles communication with mobile networks. It allows a phone to connect for calls, texts, and mobile data. Because it is such an important component, a flaw affecting it deserves attention, even if the conditions needed to exploit it limit the number of potential victims.
The vulnerability does not mean every unpatched Pixel can be hacked from anywhere on the internet, nor has Google said that simply being within wireless range of a phone is enough. The available information indicates that an attacker needs access to an adjacent network and basic privileges on the targeted device, but it does not explain how those privileges are obtained.
Attackers commonly need more than one step to compromise a well-protected device. One weakness may give them a limited foothold, while another lets them escape restrictions and gain access to more sensitive functions or data.
This is why bugs like this can be especially useful in targeted operations. An attacker may combine the modem vulnerability with another exploit, a malicious app, stolen credentials, or physical access to the device. Each part of the chain brings the attacker one step closer to compromising the device: getting in, gaining more privileges, and accessing the information or functions they’re after.
While Android users should always install the latest update offered by their device manufacturer, this particular zero-day appears in the Pixel-specific bulletin. Google’s Pixel phones use hardware and software components that other Android manufacturers do not necessarily share, including the affected modem component. If you have another Android brand, you won’t receive this specific Pixel fix, but you should still check for your manufacturer’s latest monthly security update.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
