CVE-2026-58704 is a high-severity improper authorization vulnerability in the cellular modem component of Google Pixel devices. A logic error in the modem code allows a permission check to be bypassed, letting an attacker with adjacent or proximal network access (such as over the cellular network) escalate privileges and break out of the modem's isolated sandbox into the broader device.

No user interaction is required to exploit this flaw - it can be triggered as a zero-click attack, without the device owner tapping a link, opening a file, or taking any action. Google has confirmed indications that this vulnerability may be under limited, targeted exploitation; the zero-click, modem-level nature of the flaw is consistent with patterns historically associated with commercial spyware or state-aligned surveillance tools. CVSS v3.1 score: 8.0 (High).

The following devices are affected, running a security patch level before 2026-09-05:

• Google Pixel 6, 6 Pro, 6a
• Google Pixel 7, 7 Pro, 7a
• Google Pixel 8, 8 Pro, 8a
• Google Pixel 9, 9 Pro, 9a and related Pixel 9 variants
• Google Pixel 10 and Pixel 11 series
• Google Pixel Tablet and Pixel Fold

Not affected / patched version:

• Any supported Pixel device updated to the 2026-09-05 security patch level or later (September 2026 Pixel Update Bulletin)

Successful exploitation may allow attackers to:

• Bypass permission checks in the cellular modem without any action from the device owner
• Escalate privileges and break out of the modem's isolated sandbox into the broader device's operating system and data
• Potentially access sensitive personal data, communications, or credentials stored on the device

CERTVU recommends the following:

1. Install the September 2026 Pixel security update immediately

   Update all supported Pixel devices and confirm the device reports a security patch level of 2026-09-05 or later, under Settings > Security & privacy > System & updates.

2. Reboot after installing the update

   Ensure the device restarts so that modem firmware and system components fully complete the update process.

3. Prioritize devices belonging to high-risk individuals

   Given Google's confirmation of limited, targeted exploitation, organizations should prioritize updates for personnel who may be higher-value targets - executives, government officials, and staff handling sensitive information.

4. Do not wait for automatic notification

   Pixel software updates can roll out gradually and vary by carrier and device configuration. CERTVU recommends manually checking for and installing the update rather than waiting for a system notification.

5. Report suspected compromise

   Given the zero-click, targeted nature of this vulnerability, any Pixel device showing signs of unusual behavior, unexpected data usage, or suspected compromise should be reported to CERTVU for investigation.