Google's September security bulletin for Pixel devices discloses a modem vulnerability the company says is already being exploited in "limited, targeted" attacks, alongside patches for 109 other flaws across its phone and tablet lineup. All supported Pixel models — the Pixel 6 through Pixel 11 series, plus Pixel Tablet and Fold devices — are being updated to the 2026-09-05 patch level.
The actively exploited bug, tracked as CVE-2026-58704, sits in the device's cellular modem subcomponent. Google's advisory describes it as "a possible permission bypass due to a logic error in the code," and says an attacker with access to an adjacent network and only basic privileges on the target device could exploit it to escalate permissions in a low-complexity attack that requires no interaction from the phone's owner, according to reporting from BleepingComputer. Google has not disclosed who is behind the exploitation or who has been targeted, and the underlying bug report remains private.
Beyond the Headline Flaw
The broader September bulletin is unusually large: 12 of the other 109 issues are rated as remote-code-execution vulnerabilities and 89 as privilege-escalation flaws, most rated critical or high severity. The wider monthly Android security bulletin, which also covers non-Pixel devices, addressed 180 vulnerabilities in total, including a critical Wi-Fi memory-corruption flaw tracked separately from the Pixel-specific modem bug.
Modem-level vulnerabilities are considered especially serious because they can sometimes be triggered over a cellular or nearby wireless connection rather than requiring a malicious app or link, narrowing an attacker's need for cooperation from the victim. Security researchers have long flagged modem and baseband code — often supplied by third-party chipmakers and audited less frequently than the core operating system — as a persistent weak point across both Android and iOS devices, a pattern this month's bulletin reinforces.
Pixel owners can install the fix by going to Settings, then Security & privacy, then System & updates, then Security update, and tapping Install before restarting the device. Google's advisory urged all customers to accept the update as soon as it becomes available, without specifying a broader rollout timeline for carriers that stage updates separately from direct Pixel deliveries.
