Pixel modem flaw patched after reported zero-click exploitation

A modem authorization bypass requiring no interaction

The Register reports that Google disclosed CVE-2026-58704, a high-severity improper-authorization vulnerability in Pixel phone cellular modems. The flaw reportedly can bypass permission checks and escalate privileges without user interaction.

Google said the issue may be under limited, targeted exploitation; updating installs the available fix. CISA subsequently listed the CVE in its Known Exploited Vulnerabilities Catalog and gave US federal agencies three days, until September 19, to patch.

Google’s warning describes possible limited, targeted exploitation before the fix.

Google has released a fix for CVE-2026-58704, while CISA has added it to its Known Exploited Vulnerabilities Catalog and set a September 19 patch deadline for US federal agencies.

A warning of limited targeted exploitation

If the report is accurate, the issue combines a modem vulnerability with zero-click exploitation, meaning an attack would not require the target to interact with a message or link. The available reporting does not establish the scope of any exploitation.