CVE-2026-58704Active Exploitation(google / android)

HIGHCVSS 8.8 · HIGHCISA KEV

Exploitation observed; activity peaked at 53 mentions and remains active

Immediate actions

Patch google android systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

google CVEs Back to dashboard

6.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-19. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor / third-party advisories

https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58704

Weakness type (CWE)

CWE-285CWE-693

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

android

Threat summary

Active exploitation appears in 121 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
146 mentions across 20 observed days

What's happening

Active exploitation reported across 121 signals
PoC mentioned or linked in 4 signals
Patch or workaround mentioned in 97 signals
Technical details provided in 109 signals
General: 9 classified signals
Peaked 18d ago at 53 mentions (2026-09-16); latest day: 1
146 total mentions across 20 days

Affected systems

Vendors

google

Products

android

1 version affected across 1 product

Deep dive

Activity timeline146 mentions / 20d

Signal classification4 categories

Active Exploitation

12182.9%

Patch

106.8%

General

96.2%

Disclosure

64.1%

Referenced assets90 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-15	1	Disclosure1
2026-09-16	53	Active Exploitation46General1Patch6
2026-09-17	47	Active Exploitation38Disclosure2General5Patch2
2026-09-18	17	Active Exploitation14Disclosure1General1Patch1
2026-09-19	7	Active Exploitation7
2026-09-20	2	Active Exploitation2
2026-09-21	5	Active Exploitation3Disclosure1General1
2026-09-22	1	Active Exploitation1
2026-09-24	1	Active Exploitation1
2026-09-25	1	Active Exploitation1
2026-09-26	1	Active Exploitation1
2026-09-27	1	Patch1
2026-09-29	1	Active Exploitation1
2026-10-02	1	Active Exploitation1
2026-10-03	1	Active Exploitation1
2026-10-09	1	Active Exploitation1
2026-10-12	1	Active Exploitation1
2026-10-14	1	Active Exploitation1
2026-10-18	2	Active Exploitation1Disclosure1
2026-10-20	1	General1

Full discourse20 posts

International Cyber Digest@IntCyberDigest44d
Active Exploitation
‼️ Google says a zero-click Pixel cellular modem vulnerability has been spotted being used in the wild in limited, targeted attacks. A logic error lets an attacker bypass permission checks and gain elevated access, though the CVE record indicates attackers need to be nearby. The September update (patch level 2026-09-05 or later) fixes CVE-2026-58704. CISA has added it to its Known Exploited Vulnerabilities catalog.
Post summary
Google reports a zero-click Pixel cellular modem vulnerability (CVE-2026-58704) being actively exploited in limited targeted attacks, with a patch available in the September 2026 update and CISA listing it as a known exploited vulnerability.
21682066817389.3K
242.8K followersView on X
The Hacker News@TheHackersNews45d
Patch
‼️ ALERT - Google says a Pixel modem flaw may be under limited, targeted exploitation. CVE-2026-58704 can enable adjacent privilege escalation without user interaction. Google patched it in the September Pixel update. What’s known about the attacks → https://thehackernews.com/2026/09/google-patches-pixel-modem-flaw-amid.html
Post summary
The tweet reports CVE-2026-58704, an adjacent privilege escalation flaw in Pixel modems, and notes that Google has patched it in the September update, while hinting at limited targeted exploitation.
123121504346.7K
2.4M followersView on X
Dark Web Informer@DarkWebInformer44d
Active Exploitation
🚨 Google confirms Pixel phones targeted in zero-click zero-day attacks Google has patched CVE-2026-58704, a high-severity vulnerability in Pixel phones' cellular modem that the company says was already under "limited, targeted exploitation." ⠀ The flaw is caused by a logic error that can allow an attacker to bypass permission checks and escalate privileges beyond the modem's isolated environment. ⠀ Most importantly, exploitation requires no interaction from the victim. No malicious link needs to be clicked and no file needs to be opened, making it a zero-click attack. ⠀ Google has not disclosed: • Who carried out the attacks • How many Pixel owners were targeted • How the victims were selected • What tools or spyware may have been deployed ⠀ CISA has added CVE-2026-58704 to its Known Exploited Vulnerabilities catalog and set a September 19 remediation deadline for affected federal systems. ⠀ Google says Pixel devices with the September 5, 2026 security patch level or later are protected. Pixel owners should update their devices immediately.
Post summary
Google confirmed CVE-2026-58704 as a zero-click zero-day actively exploited in limited targeted attacks on Pixel phones, with a patch available and CISA adding it to the KEV catalog.
173261192522.2K
243.9K followersView on X
Yellow Media@YellowMedia_HQ44d
Active Exploitation
CISA orders federal agencies to patch Pixel devices as Google fixes CVE-2026-58704, a zero-click cellular modem vulnerability exploited in targeted attacks https://yellow.com/news/google-pixel-zero-day-modem-fixes
Post summary
CISA has ordered federal agencies to patch CVE-2026-58704, a zero-click cellular modem vulnerability, after Google released a fix. The vulnerability is confirmed to be actively exploited in targeted attacks.
1850119118.5K
2.7K followersView on X
xvonfers@xvonfers46d
Active Exploitation
(CVE-2026-58704)[484011314][Modem]Logic error->permission bypass->EoP(proximal/adjacent) in Cellular Modem, exploited ITW https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01#pixel
Post summary
The post confirms that CVE-2026-58704, a logic error causing privilege escalation in cellular modems, is being actively exploited in the wild, with technical details provided but no explicit PoC or patch mentioned.
18039153.2K
5.0K followersView on X
valeria lenoir@VLenoir1393745d
Active Exploitation
Si tienes un Google Pixel, revisa tus actualizaciones. Google parcheó un zero-day en el módem celular (CVE-2026-58704) que no requiere interacción del usuario y ya hay indicios de explotación limitada y dirigida. Mira tu nivel de parche: 2026-09-05 o posterior. #Pixel #Android #Ciberseguridad
Post summary
The post announces a patched zero-day in Google Pixel cellular modems and reports indications of limited, targeted exploitation. It also directs users to verify a specific patch level.
641316882
2.1K followersView on X
Ratan Jyoti@reach2ratan45d
Patch
🚨 Spyware Vector? CISA Flags Urgent Google Pixel Zero-Day Flaw Threat Breakdown: CVE-2026-58704 What is this attack? CVE-2026-58704 is a high-severity elevation of privilege (EoP) zero-day rooted in improper authorization and a protection-mechanism failure inside Google Pixel's Cellular Modem firmware. A logic error bypasses internal permission gates, allowing an attacker on an adjacent/proximal radio network (or an actor with basic execution foothold) to escalate privileges to elevated system/modem execution contexts with zero user interaction. These characteristics align with commercial spyware and targeted surveillance tooling. How to identify the attack? Because exploitation occurs inside baseband/modem memory buffers: Host logs: Monitor Android logcat / dmesg for crash dumps originating from rild (Radio Interface Layer Daemon), abnormal IPC requests across modem binder interfaces, or unexpected crashes in baseband services. Network/RF Layer: Detection typically requires baseband telemetry or mobile threat defense (MTD) tools looking for anomalous non-standard over-the-air cellular control frames, rogue base stations (IMSI catchers), or unusual outbound telemetry following baseband state changes. Mitigation Update all Google Pixel hardware immediately to security patch level 2026-09-05 or later (Settings > Security & privacy > System & updates > Security update). Restrict exposure in high-threat environments by enabling Airplane Mode and using trusted Wi-Fi networks when proximal RF tampering is suspected. Indicators of Compromise (IoCs) Patch Level: Vulnerable if patch string is older than 2026-09-05. Artifacts: Unscheduled baseband resets, unexplained dumps under /data/vendor/radio/ or /data/vendor/modem_dump/, and anomalous persistent processes running under UID radio or UID system. YARA Rule Modem zero-days are executed in volatile baseband memory or via weaponized payload binaries dropped after elevation. The following rule scans Android memory dumps, binaries, or staging directories for attempts to interact directly with modem interfaces or exploit cellular IPC logic: rule Suspicious_Pixel_Modem_EoP_Exploit { meta: description = "Detects potential exploit payloads targeting Google Pixel cellular modem IPC / CVE-2026-58704" author = "Threat Intel" severity = "High" reference = "CVE-2026-58704" date = "2026-09-16" strings: $dev_modem = "/dev/block/by-name/modem" ascii $rild = "/vendor/bin/hw/android.hardware.radio" ascii $PROP = "http://vendor.ril.modem" ascii $binder_sub = "http://android.hardware.radio.config" ascii $escalate_str1 = "setprop sys.usb.config" ascii $escalate_str2 = "chmod 0666 /dev/radio" ascii condition: uint32(0) == 0x464C457F and // ELF header (2 of ($dev_modem, $rild, $PROP, $binder_sub)) and (1 of ($escalate_str1, $escalate_str2)) } #CyberSecurity #ZeroDay @reach2ratan #Android #GooglePixel #InfoSec #ThreatIntel #CISA #CVE202658704
Post summary
The text provides a detailed technical analysis of CVE-2026-58704, a high-severity EoP zero-day in Google Pixel's cellular modem firmware, and primarily directs users to apply security patch level 2026-09-05 or later, accompanied by IoCs and a YARA detection rule.
0150196618
26.9K followersView on X
Dark Web Intelligence@DailyDarkWeb44d
Active Exploitation
🔴 Google Pixel vulnerability exploited Google says CVE-2026-58704 — a high-severity elevation-of-privilege issue in the Pixel cellular modem — may be under limited, targeted exploitation. Per the bulletin: privilege escalation without user interaction. Patch level 2026-09-05 or later addresses it (and the rest of the September 2026 Pixel bulletin). ⚠️ Framing is Google’s: limited / targeted — not a mass-exploitation claim. Official bulletin: https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01 #ThreatIntel #CyberSecurity #Android #Pixel #Vulnerability
Post summary
Google indicates that CVE-2026-58704, a high‑severity elevation‑of‑privilege flaw in the Pixel cellular modem, may be under limited, targeted exploitation and can be leveraged without user interaction. A patch is available in Pixel build 2026-09-05 or later, addressing the issue along with other September 2026 fixes.
0112467.1K
209.0K followersView on X
CISA Cyber@CISACyber45d
Active Exploitation
🛡️ We added Google Pixel improper authorization vulnerability CVE-2026-58704 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/8RZJMrb944
Post summary
CISA added CVE-2026-58704 (Google Pixel improper authorization) to its KEV catalog, signaling active exploitation, and advises applying mitigations.
2921728.3K
303.4K followersView on X
opsek@opsek_io44d
Active Exploitation
⚠️ Zero-day zero-click exploit for Google Pixel phones 🚨 Google has reported they detected a vulnerability being exploited in the wild in very specific surgical attacks. This vulnerability is fixed with the last September 5 update. CVE-2026-58704. "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." More info and links 👇
Post summary
The post reports an actively exploited zero-click zero-day vulnerability (CVE-2026-58704) in Google Pixel cellular modems, confirming in-the-wild targeted attacks and noting a patch was released in the September 5 update.
241843.4K
1.1K followersView on X
SammyGuru@sammygurus45d
Active Exploitation
Google confirmed a Pixel cellular modem vulnerability was exploited in targeted attacks. - CVE-2026-58704 is a permission bypass caused by a logic error in the modem - Patched in the September 2026 Pixel security update - That update fixes more than 200 security issues in total - CISA has added CVE-2026-58704 to its Known Exploited Vulnerabilities catalog Google still hasn't said which Pixel models were targeted, or by whom.
Post summary
Google confirmed that CVE-2026-58704, a permission bypass in Pixel cellular modem, was exploited in targeted attacks and patched in the September 2026 Pixel security update; CISA added it to its KEV catalog.
310120804
6.2K followersView on X
عالم التكنولوجيا@Q8Pro45d
Active Exploitation
تنبيه عاجل 🧨 ثغرة في مودم بيكسل (CVE-2026-58704) تتيح تصعيد امتيازات مجاور بدون تفاعل المستخدم، وقد تُستغل حالياً بهجمات محدودة. قوقل أصلحتها في تحديث سبتمبر. حدّث جهازك فوراً! https://t.co/4ZFZSbIy6V
Post summary
The text reports that CVE-2026-58704 in the Pixel modem may be actively exploited in limited attacks. It also says Google fixed it in the September update and urges users to update immediately.
0101026.5K
627.0K followersView on X
Alan McCright 🇺🇸@Alan_McCright44d
Disclosure
GrapheneOS is not automatically immune. Current GrapheneOS builds do not yet include the patched modem firmware.The project confirmed on their forum that CVE-2026-58704 is in the September 2026 Pixel bulletin and will be in an upcoming GrapheneOS release, not one already shipping. The delay is because Google’s Pixel drop is Android 17 QPR1, which is not in AOSP, so GrapheneOS has to backport the firmware, drivers, and HALs.
Post summary
The text discloses the status of CVE-2026-58704 in GrapheneOS, noting that current builds lack the patched modem firmware from the September 2026 Pixel bulletin and explaining the backporting delay. It focuses on vulnerability announcement and patch planning without claiming exploitation or providing exploit/PoC details.
32061378
5.4K followersView on X
Daily CyberSecurity@Daily_CyberSec45d
Active Exploitation
Google confirmed a Pixel modem zero-day (CVE-2026-58704) exploited in a zero-click spyware attack to escape the modem sandbox. Update now. #Pixel #ZeroDay #CVE202658704 #Google #Spyware #ZeroClick #CyberSecurity https://securityexpress.info/pixel-modem-zero-day/
Post summary
The tweet confirms CVE-2026-58704 was actively exploited in a zero-click spyware attack targeting Pixel modems, but provides no specific patch details or PoC references.
22061539
13.0K followersView on X
Dr. Mazin Al-Busaidi@mazin_dr3873745d
Active Exploitation
🚨 تحذير أمني عاجل! ثغرة خطيرة في أجهزة Google Pixel تُستغل الآن في هجمات حقيقية! 📌 CVE-2026-58704 — ثغرة رفع الصلاحيات في مكوّن المودم الخلوي ⚠️ ماذا تفعل الآن؟ ✅ حدّث جهازك فوراً إلى مستوى التصحيح 2026-09-05 ✅ لا تنتظر — الهجمات جارية الآن! Google أصدرت تحديثاً طارئاً ضمن Pixel Update Bulletin لسبتمبر 2026 🔗 http://cybersecuritynews.com/android-pixel-zero-day #cybersecuritynews #GooglePixel #ZeroDay #AndroidSecurity #ثغرات_أمنية #أمن_المعلومات
Post summary
The post warns that CVE-2026-58704, a privilege escalation vulnerability in Google Pixel's cellular modem, is actively being exploited in the wild and urges immediate patching to the September 2026 security level.
03070102
1.2K followersView on X
MadeItHappen@MadeItHappenX45d
Active Exploitation
Pixel September bulletin includes a modem zero-day Google says is under limited targeted exploitation. Adjacent network. Basic privileges. No user click. CVE-2026-58704. If you are still on last month's build, that is the one. https://t.co/7lJMQFeCFQ
Post summary
The text reports CVE-2026-58704 as a Pixel modem zero-day under limited targeted exploitation. It includes attack-condition details such as adjacent network access, basic privileges, and no user interaction, while not providing PoC or exploit-code details.
10070114
283 followersView on X
PurpleIris@PurpleIrisHQ22d
Active Exploitation
Google Pixel is affected by CVE-2026-58704 (CVSS 8.8 - High), an improper authorization flaw in the cellular modem that needs no user interaction, exploited in the wild. Install the September 2026 Pixel security update. Read more: http://purpleiris.io/cti/CVE-2026-58704 #CVE #Google #ThreatIntelligence #CyberSecurity
Post summary
The post reports that CVE-2026-58704, an improper authorization flaw in the Google Pixel cellular modem, is exploited in the wild. It also directs readers to install the September 2026 Pixel security update.
03040115
57 followersView on X
Kaspersky Türkiye@KasperskyTR19d
Active Exploitation
Google’ın yayınladığı son güvenlik yaması, hedefli siber saldırılarda aktif olarak kullanılan CVE-2026-58704 sıfır gün (zero-day) açığı da dahil olmak üzere toplam 110 zayıf noktayı gideriyor. ⚠️📱 🔹 Google Pixel cihazları neden özel güvenlik güncellemeleri alır? 🔹 Kapatılan en tehlikeli güvenlik açığı nedir? 🔹 Cihazınızı siber saldırı kurbanı olmaktan nasıl korursunuz? Tüm bu soruları Kaspersky Daily'deki son yazımızda cevapladık. 📝 🔗 https://www.kaspersky.com.tr/blog/ #Kaspersky #SiberGüvenlik #Google #Pixel
Post summary
The tweet reports that CVE-2026-58704 zero-day is actively exploited in targeted cyber attacks and is addressed by Google's latest security patch, linking to a Kaspersky Daily blog post for further details.
31020815
5.0K followersView on X
kokumօtօ@__kokumoto45d
Active Exploitation
米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が既知の悪用された脆弱性カタログに1件と2件の脆弱性を追加。 - CVE-2026-58704 (Google Pixel) - CVE-2026-76460 (Cisco ISE) - CVE-2026-87886 (Acronis Backup) 対処期限は3日後の9/19。 https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-one-known-exploited-vulnerability-catalog https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog
Post summary
CISA added three CVEs (CVE-2026-58704 Google Pixel, CVE-2026-76460 Cisco ISE, CVE-2026-87886 Acronis Backup) to its Known Exploited Vulnerabilities catalog with a September 19 remediation deadline, confirming these vulnerabilities are actively exploited in the wild.
100401.0K
7.8K followersView on X
TuTecnoMundo@TuTecnoMundo37d
Active Exploitation
🔴 Si tienes un Pixel, instala ya el parche de seguridad de septiembre: corrige un zero-day del módem que ya se ha explotado. Google ha corregido la vulnerabilidad CVE-2026-58704, de gravedad alta, que se ha usado en ataques dirigidos sin que el usuario tenga que tocar nada. Afecta a todos los Pixel con soporte y se soluciona con el nivel de parche 5 de septiembre de 2026 o posterior. La actualización llega por fases e incluye 110 correcciones. Tras instalarla hay que reiniciar el móvil para que proteja. Si conocéis a alguien con un Pixel, pasádselo para que actualice.
Post summary
The text reports that CVE-2026-58704, a high-severity zero-day in Pixel modem firmware, has been actively exploited in targeted attacks and urges immediate installation of the September 2026 security patch.
000401.5K
107.7K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	google	android	-	-	-

Explore more

Back to dashboard google CVEs android vulnerabilities

What researchers are saying

CVE-2026-58704

International Cyber Digest[verified]@IntCyberDigestActive Exploitation

Google reports a zero-click Pixel cellular modem vulnerability (CVE-2026-58704) being actively exploited in limited targeted attacks, with a patch available in the September 2026 update and CISA listing it as a known exploited vulnerability.

Yellow Media[verified]@YellowMedia_HQActive Exploitation

CISA has ordered federal agencies to patch CVE-2026-58704, a zero-click cellular modem vulnerability, after Google released a fix. The vulnerability is confirmed to be actively exploited in targeted attacks.

valeria lenoir[verified]@VLenoir13937Active Exploitation

The post announces a patched zero-day in Google Pixel cellular modems and reports indications of limited, targeted exploitation. It also directs users to verify a specific patch level.

Ratan Jyoti[verified]@reach2ratanPatch

The text provides a detailed technical analysis of CVE-2026-58704, a high-severity EoP zero-day in Google Pixel's cellular modem firmware, and primarily directs users to apply security patch level 2026-09-05 or later, accompanied by IoCs and a YARA detection rule.

Dark Web Intelligence[verified]@DailyDarkWebActive Exploitation

Google indicates that CVE-2026-58704, a high‑severity elevation‑of‑privilege flaw in the Pixel cellular modem, may be under limited, targeted exploitation and can be leveraged without user interaction. A patch is available in Pixel build 2026-09-05 or later, addressing the issue along with other September 2026 fixes.

opsek[verified]@opsek_ioActive Exploitation

The post reports an actively exploited zero-click zero-day vulnerability (CVE-2026-58704) in Google Pixel cellular modems, confirming in-the-wild targeted attacks and noting a patch was released in the September 5 update.

SammyGuru[verified]@sammygurusActive Exploitation

Google confirmed that CVE-2026-58704, a permission bypass in Pixel cellular modem, was exploited in targeted attacks and patched in the September 2026 Pixel security update; CISA added it to its KEV catalog.

عالم التكنولوجيا[verified]@Q8ProActive Exploitation

The text reports that CVE-2026-58704 in the Pixel modem may be actively exploited in limited attacks. It also says Google fixed it in the September update and urges users to update immediately.