In short: Google rushed out a fix for a zero-day vulnerability, CVE-2026-58704 (CVSS 8.0), in the cellular modem of Pixel phones — it let an attacker on an adjacent network escalate privileges and reach device data with zero user interaction: no tap, no call, no app install. Google confirmed the flaw had already been used in limited, spyware-style attacks against a narrow set of targets. The patch shipped on September 15, 2026, and on September 16 CISA added the bug to its Known Exploited Vulnerabilities catalog.
What happened
CVE-2026-58704 is a logic error in Pixel's cellular modem firmware: the device fails to properly check permissions for certain modem commands. The attack vector is "adjacent network," attack complexity is low, and no user interaction is required at all. In some scenarios the flaw let an attacker break out of the modem's isolated sandbox and reach other components of the phone — effectively full device compromise without a clicked link, an answered call, or a malicious app install.
All supported models are affected, from Pixel 6 through Pixel 11. The fix is included in the September 5, 2026 security patch level.
Already used in attacks
According to The Hacker News, Google found signs of "limited, targeted" exploitation of CVE-2026-58704 — phrasing that in practice almost always points to commercial spyware or state-linked operations rather than mass cybercrime. No public exploit code is available. On September 16, 2026, CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave federal agencies a three-day deadline to patch — a strict window reserved for vulnerabilities with confirmed real-world exploitation. Russian outlets, including iXBT, confirmed the phone could be hijacked "quietly" — no call, no link, no app.
Why this matters beyond Pixel owners
Zero-click modem attacks are among the most dangerous vulnerability classes: they bypass every standard piece of digital hygiene advice ("don't click links," "don't install unverified apps") because the victim doesn't need to do anything at all. It's the same risk class we covered in the Telegram zero-click sticker RCE story: the deeper a bug sits in a device's system layer — modem, kernel, media parser — the less a user can protect themselves, and the more everything depends on how fast the manufacturer ships a fix.
How to protect yourself
Update your Pixel now. Check the security patch level in Settings → System → System update — it should be at or above the September 5, 2026 level. Keep auto-updates on at all times; they close the exposure window fastest.
Reduce your network-level exposure. The attack vector is "adjacent network," so caution around unfamiliar Wi-Fi and shared networks narrows the attack surface. Encrypting your traffic with LiMP VPN can't patch the modem flaw itself — that's on the manufacturer — but it protects your data in transit if you're on an untrusted network before the patch lands. Learn more on the LiMP VPN features page.