Google has patched a zero-day vulnerability in Pixel phones that attackers were already exploiting in the wild, the company disclosed as part of its latest security update. The flaw, tracked as CVE-2026-58704, resides in the device’s cellular modem component and has been rated high severity.
According to the vulnerability record, the issue stems from a logic error that creates a permission bypass in the modem, allowing an attacker in remote proximal or adjacent range to escalate privileges without needing any additional execution rights. Critically, no user interaction is required to trigger the exploit, making it a zero-click attack vector.
Google confirmed it is aware of “limited, targeted exploitation” of the flaw but has not attributed the activity to a specific threat actor. The zero-click, modem-level nature of the bug, combined with the narrow and targeted framing of the exploitation, mirrors patterns seen in past attacks tied to commercial spyware operators and state-sponsored groups.
CISA Adds Flaw to KEV Catalog
The Cybersecurity and Infrastructure Security Agency has added CVE-2026-58704 to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies are required to prioritize remediation of vulnerabilities listed in the KEV catalog, particularly those found on publicly exposed assets capable of granting attackers full control post-exploitation.
While the directive applies only to federal agencies, CISA is urging all organizations to adopt risk-based patching practices and treat KEV Catalog entries as top remediation priorities.
Broader Patch Includes Dozens of Critical Fixes
The update bundling the Pixel modem fix also delivers the latest Android security patches and resolves more than 100 additional vulnerabilities specific to Pixel devices. Nearly 50 of these carry critical severity ratings, enabling remote code execution or privilege escalation across components including the multimedia subsystem, VPU, modem, telephony stack, bootloader, and trusted execution environment (TEE).
Most of the remaining vulnerabilities are rated high severity and can lead to remote code execution, privilege escalation, information disclosure, or denial of service. Pixel owners are advised to install the latest security update immediately given the confirmed active exploitation of CVE-2026-58704.