Google Patches Actively Exploited 0-Day in Pixel

Google has released its September security update for Pixel devices, closing 110 vulnerabilities in total. Among them is one zero-day flaw that, according to the company, is already being used in targeted attacks.

A vulnerability in the modem

The issue, tracked as CVE-2026-58704, stems from improper authorization and a failure of protective mechanisms in the cellular modem subsystem. According to Google, a logic error in the code makes it possible to bypass a permission check. As a result, an attacker on an adjacent network with basic privileges on the device can escalate their rights. The attack is rated as low in complexity and requires no interaction on the user's part.

The company notes that there are indications of “limited, targeted exploitation” of this vulnerability. All supported Google devices will receive an update to patch level 2026-09-05, and Google is urging users to install it.

Another 109 fixes

The remaining 109 issues addressed include 12 vulnerabilities allowing remote code execution and 89 privilege-escalation vulnerabilities rated critical or high severity.

As a reminder, although Pixels run on Android, they receive separate security updates — unlike the shared monthly patch set for other manufacturers. The reason is that the hardware platform of these smartphones is fully controlled by Google and has exclusive capabilities. To install the update, a Pixel owner needs to open “Settings → Security & privacy → System & updates → Security update” and reboot the device.

This is not the first live zero-day in Google's mobile ecosystem this year. In June, the company patched an actively exploited Android Framework vulnerability (CVE-2025-48595) that allowed code execution and privilege escalation on devices running Android 14 and later. And a month before that, Google revised its bug bounty programs for Android and Chrome: payouts for flaws that are easier to find with the help of artificial intelligence were cut, but the company is still willing to pay up to $1.5 million for certain Android exploits.

Source: Bleeping Computer