Google Pixel Improper Authorization Vulnerability
TL;DR 📌
- Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.
- Highest CVSS: 8.0 (High).
- Listed in CISA KEV (2026-09-16) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-58704.
What it is
CVE-2026-58704 is an improper authorization flaw in the cellular modem component of Google Pixel devices. NVD describes it as a permission bypass caused by a logic error in the modem code.
The attack vector is adjacent network (AV:A) rather than remote-over-internet: an attacker needs to be proximal to the device, likely operating over the cellular/radio link that the modem handles. The CVSS vector shows low attack complexity, low privileges required, and no user interaction needed — meaning a device owner doesn’t have to click, tap, or approve anything for exploitation to occur.
Impact is rated high across confidentiality, integrity and availability (C:H/I:H/A:H), consistent with the summary’s description of privilege escalation. The logic error allows an attacker to bypass permission checks that should otherwise gate access, and escalate privilege without needing additional execution rights on the device first.
This is listed in CISA’s Known Exploited Vulnerabilities catalogue, added 16 September 2026, so it is known to be exploited.
What to do
- Apply the vendor security update for affected Pixel devices as soon as it is available; the advisory does not list fixed versions or a patch level here, so check the Google Pixel security bulletin directly for the specific build that resolves CVE-2026-58704.
- Because this is in the KEV catalogue, treat patching as time-sensitive rather than routine — follow your organisation’s KEV remediation SLA for any managed Pixel fleet.
- Given the adjacent-network attack vector, be aware that physical proximity or radio-level access to the device is the relevant exposure; this is not something that can be mitigated by network firewalling or VPN policy.
- Confirm with your MDM or device management platform whether it can report Pixel patch levels, so you can track remediation across a fleet rather than relying on individual users to update.
For leadership 🧭
Executive summary. Pixel devices have a flaw in the cellular modem that lets a nearby attacker escalate privileges without the user clicking or approving anything, and it is already listed as actively exploited. Any managed Pixel fleet should be patched under your fastest remediation timetable rather than normal update cycles.
Why it matters:
- The flaw sits in the cellular modem itself, so exploitation happens over the radio link rather than through Wi-Fi, apps, or the internet-facing network stack you might already be monitoring.
- No user interaction and no extra privileges are required, meaning a device owner would see nothing unusual while an attacker nearby escalates privilege on the handset.
- Impact is rated high for confidentiality, integrity and availability together, matching a genuine privilege escalation rather than a minor information leak.
- This CVE is in CISA’s Known Exploited Vulnerabilities catalogue, so it is confirmed to be exploited, not merely theoretical.
Now / Next / Later:
- Now: Check the Google Pixel security bulletin for the build that resolves CVE-2026-58704 and identify which devices in your fleet are still unpatched.
- Next: Push the modem/firmware update to all managed Pixel devices through your MDM, treating it as a KEV-driven emergency change rather than a scheduled rollout.
- Later: Build ongoing MDM reporting on Pixel patch levels so modem and firmware updates are tracked and enforced fleet-wide, since this exposure can’t be mitigated by firewall or VPN controls.