Google confirms Pixel phones were exploited in ‘targeted’ attack related to modem

Google has disclosed that a select number of Pixel smartphones were targeted in an attack linked to a flaw in the device's modem. As part of the September 2026 security update, Google addressed more than 200 security loopholes, but highlighted that one of them was actively exploited in the wild. Specific evidence suggests that CVE-2026-58704 may have been subject to limited, targeted exploitation.

The issue stems from the modem, requiring no user interaction for exploitation. CVE-2026-58704 involves a potential permission bypass due to a coding error, enabling remote (proximal/adjacent) privilege escalation without additional execution privileges. The exact method of exploitation and affected models remain unclear. However, CISA, via The Hacker News, confirms that Pixel phones were targeted, stating, "Google Pixel devices contain an improper authorization vulnerability in the cellular modem."

Google has not provided further details on the attackers or motives behind the attack, nor whether Google has commented on the exploitation. Pixel owners are advised to update to the September 2026 patch immediately to address the vulnerability.