Description
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In plain language
AI Act nowThis is a serious Android cellular modem flaw that a nearby attacker can use to bypass permissions and gain full control of the phone without you clicking anything—if your device is in the affected line/config, you should act now.
CVE-2026-58704 is a permission-bypass logic flaw in the Android Cellular Modem that enables nearby (proximal/adjacent) escalation of privilege and total compromise of security controls without authentication or user interaction; it has been listed in CISA KEV with reported limited, targeted exploitation in Pixel devices.
What to do now
- Check whether your business uses the affected Android devices (especially Pixel models) and whether they received the Android security update linked in the bulletin for 2026-09-01.
- If not updated, apply the vendor-provided fix from the Pixel security bulletin (2026-09-01).
- If you cannot patch immediately, reduce exposure of the devices by restricting who can physically access them and minimizing time they spend in uncontrolled areas (since the attacker must be nearby).
- After updating, verify the device is on the updated security patch level and monitor for any unusual modem/network or security behavior in your device management logs.
CVSS Vector Breakdown
AV:AAttack VectorAC:LAttack ComplexityPR:NPrivileges RequiredUI:NUser InteractionS:UScopeC:HConfidentialityI:HIntegrityA:HAvailabilityWeaknesses
Affected Products
Exploitability
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
References
- Google патчит 0-day-уязвимость в устройствах Pixelru-ru·Хакер (xakep.ru)·
- Pixel Modem Zero-Day Exploited in Targeted Attacksen-us·SecurityWeek· Exploited Google Pixel zero-day
- Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitationen·The Hacker News· Exploited Pixel Cellular Modem mobile
- Google fixes actively exploited Android zero-day on Pixel devicesen-us·BleepingComputer· Exploited Pixel Cellular Modem mobile
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-58704 and every CVE in our database. Create a free account — no credit card required.
Create Free Account