Google on Tuesday informed Pixel phone owners that it has patched a zero-day vulnerability exploited in targeted attacks.
The zero-day is tracked as CVE-2026-58704, and Google said it’s aware of “limited, targeted exploitation”.
The vulnerability has been rated high severity and affects the Pixel’s modem component.
“In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation,” reads the CVE record for CVE-2026-58704.
Google has not attributed the exploitation to a specific threat actor, but the modem-level, zero-click nature of the flaw and the company’s ‘limited, targeted’ framing are hallmarks of past attacks linked to commercial spyware vendors or state-sponsored actors.
The latest Pixel updates also include the most recent Android security patches. They also resolve more than 100 other vulnerabilities that are specific to Pixel devices.
Nearly 50 vulnerabilities have critical severity, enabling remote code execution or privilege escalation. The critical flaws affect the multimedia subsystem, VPU, modem, telephone, bootloader, TEE, libpixelimsmedia, GDMC, GSA, GPCA, and other components.
Most of the remaining vulnerabilities are high severity, and exploiting them can lead to remote code execution, privilege escalation, information disclosure, and denial of service (DoS).
Related: Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews
Related: How a $50,000 Exploit Chain Turned Bixby Against Samsung Phones
Related: What’s Hiding in Your Mobile Apps? Lookout MSEC Aims to Find Out
