Quick Answer
Google has patched a high-severity Pixel modem zero-day that it says may be under limited, targeted exploitation. Installing the September 2026 security update with patch level 2026-09-05 or later addresses CVE-2026-58704. Check for the update now, then restart your Pixel to complete installation because the patch does not protect a phone until the updated software is installed.
Key Takeaways
- Google says CVE-2026-58704 may be under limited, targeted exploitation.
- The Pixel modem vulnerability is rated High and involves elevation of privilege.
- The September 2026 Pixel release addresses 110 Pixel vulnerabilities in total.
- Security patch level 2026-09-05 or later fixes every issue listed in Google’s bulletin.
- Pixel updates can roll out gradually, so some devices may not receive the download immediately.
What is the Pixel modem zero-day Google patched?
The Pixel modem zero-day is CVE-2026-58704, a high-severity elevation-of-privilege vulnerability in the Pixel Modem subcomponent. Google said on September 15, 2026, that there are indications the vulnerability may be under limited, targeted exploitation, which means the company has evidence suggesting the flaw has been used against a narrow set of targets rather than broadly across all Pixel owners.
Google’s September 2026 Pixel Update Bulletin lists CVE-2026-58704 among 110 Pixel vulnerabilities addressed in the release. The modem is the phone component responsible for connecting to cellular networks, so a vulnerability in that area deserves prompt attention even though Google has not publicly described the targets, attackers, or specific attack campaigns involved. Google also has not publicly identified which Pixel models are affected or how many people were targeted, according to independent vulnerability reporting, so Pixel owners should not assume a particular model is safe based on its name alone.
The most important point is that a zero-day is not simply a software defect discovered before a routine update. A zero-day is a vulnerability that becomes especially urgent when defenders believe attackers may already be using it before most users have applied a fix. Pixel owners should install the update rather than wait for a later monthly release.
How serious is CVE-2026-58704 for Pixel owners?
CVE-2026-58704 is serious because Google rates the Pixel modem vulnerability as High and classifies it as an elevation-of-privilege issue. Elevation of privilege means an attacker could gain access or capabilities beyond the permissions they should have, which can weaken the security boundaries that normally isolate apps, services, and device components.
The NIST National Vulnerability Database entry for CVE-2026-58704 identifies the flaw as affecting Google Pixel devices. Independent reporting describes the problem as a permission bypass caused by a modem-code logic error, with the potential for remote, proximal, or adjacent privilege escalation without additional execution privileges or user interaction.
CISA added CVE-2026-58704 to its Known Exploited Vulnerabilities catalog on September 16, 2026, according to the Canadian Center for Cyber Security advisory. That action indicates that government defenders consider the flaw important enough to track as an exploited vulnerability, which strengthens the case for installing the September update promptly.
That technical description does not mean every Pixel is actively compromised or that ordinary users will see visible evidence of an attack. Google specifically describes the observed exploitation as limited and targeted. At the same time, the lack of required user interaction makes patching more important, because avoiding suspicious links or unknown app downloads alone may not address the underlying exposure.
| Issue | Verified detail | Why it matters | Recommended action |
|---|---|---|---|
| CVE-2026-58704 | High-severity Pixel Modem elevation-of-privilege vulnerability | Attackers may gain permissions beyond intended limits | Install the September 2026 security update |
| Exploitation status | Google says exploitation may be limited and targeted | The vulnerability may have been used before broad patch adoption | Check for the update immediately |
| Patch requirement | Security patch level 2026-09-05 or later | The fix applies only after the updated software is installed | Restart the Pixel after installation |
Which Pixel update fixes the modem zero-day?
The September 2026 Pixel security update fixes CVE-2026-58704 when the device shows security patch level 2026-09-05 or later. Google states that patch level 2026-09-05 or later addresses every issue listed in the September Pixel bulletin, including the actively exploited modem vulnerability.
The September release contains 110 Pixel vulnerabilities in total, including critical and high-severity issues alongside the modem flaw. Google’s bulletin lists Critical Pixel issues in components that include the IP Multimedia Subsystem, modem, telephony, bootloader, and trusted-execution environment, which support core functions such as communications, startup security, and protected processing. That broader patch set is another reason not to treat the download as a fix for only one issue. Monthly security updates often address several components that work below the apps and settings most users interact with every day.
Pixel owners should verify the installed security patch level after the phone restarts. An update notification can indicate that a package is ready, but the device is not fully protected until installation completes and the phone reports the newer software status. Users who have delayed updates because of storage concerns should make space and install the security release as soon as practical.
Security updates also protect data stored in apps and accounts, which matters for people managing credentials through Android passkey transfers or other account-security features. A strong sign-in method remains valuable, but it does not replace prompt operating-system patching when Google identifies a potentially exploited device vulnerability.
How do you install the September Pixel security update?
To install the September Pixel security update, open Settings, then select Security & privacy, System & updates, and Security update. The phone will check whether an update is available, and you can follow the on-screen prompts to download and install it before restarting the device. Back up important files first, particularly if the phone contains work documents, photos, or authentication data, because a backup reduces the consequences of an interrupted installation even though security updates are designed to preserve personal data.
- Open the Settings app on the Pixel phone.
- Select Security & privacy.
- Select System & updates.
- Select Security update to check for the September release.
- Download and install the available update.
- Restart the Pixel phone when prompted, then confirm the security patch level is 2026-09-05 or later.
The update process described in independent reporting on Google’s Pixel fix ends with a restart because the updated system components must load before the patch takes effect. Connect to a reliable network and keep enough battery charge to avoid interrupting the installation.
Stop and contact Google Pixel support or your carrier if the update repeatedly fails, the phone cannot restart normally, or the device reports an installation error that does not clear after another update check. Do not attempt unofficial modem firmware changes or factory-reset the phone solely to resolve a delayed security update, because those actions do not substitute for the official patch and can create avoidable data-loss problems.
Why might the September Pixel update not appear yet?
The September Pixel update may not appear immediately because Google says Pixel software updates roll out gradually and can take a few weeks depending on the device and carrier. A delayed notification does not mean the phone is already patched, so Pixel owners should check the Security update screen manually instead of relying only on an automatic alert.
Carrier involvement can affect when a particular device receives an update, even when Google has published the relevant bulletin and made the patch available for the broader Pixel update cycle. The practical response is to check the update page regularly until the device installs security patch level 2026-09-05 or later.
Google’s supported-device policy also affects the long-term security outlook. Pixel 8 and newer models receive seven years of operating-system and security updates from their initial US Google Store availability date. Pixel 6, Pixel 6a, Pixel 6 Pro, Pixel 7, Pixel 7a, Pixel 7 Pro, and Pixel Fold receive five years of updates under Google’s stated policy.
Older supported Pixel models can still receive this patch when eligible, but owners should not assume every Pixel model has the same remaining support window. Checking the installed patch level is more useful than assuming a phone is protected because it has received past updates.
What should Pixel owners do while waiting for the security update?
Pixel owners should check for the official security update daily while waiting for the September release to reach their device. Google has identified the exploitation as limited and targeted, so there is no verified basis to conclude that a typical Pixel owner has been attacked. However, the confirmed possibility of active exploitation makes waiting without checking unnecessary.
Pixel owners should also protect the accounts connected to the phone with unique passwords and available passkeys or multi-factor authentication. Account protection will not patch the modem vulnerability, but it can reduce the impact of separate account-compromise attempts that often follow phishing messages, credential theft, or reused passwords.
Security incidents involving other services show why device patching and account security need to work together. Users concerned about suspicious wallet or account emails should treat messages carefully, particularly after incidents such as the phishing email exposure involving customer contact data. Do not install software from a message claiming to provide an emergency Pixel fix.
The most sensible approach is to install only the update offered through the Pixel Settings app. Google has not instructed users to download modem files, use third-party repair tools, or change hidden network settings to address CVE-2026-58704. Official updates are the appropriate remedy for this vulnerability.
Does the Pixel modem zero-day affect every Android phone?
The Pixel modem zero-day is identified in Google’s September Pixel Update Bulletin as affecting the Pixel Modem subcomponent, not as a general Android vulnerability affecting every Android phone. The available information supports a direct warning for Pixel owners, while it does not establish that phones from every Android manufacturer are exposed to CVE-2026-58704.
Android phones use different hardware, modem components, software builds, and manufacturer update processes. A security issue in a Pixel-specific component can require a Pixel-specific fix, which is why users should follow the security-update guidance from the company that makes their particular phone rather than attempting to apply a Pixel package elsewhere.
Android users with a non-Pixel phone should still install their manufacturer’s current security update when it becomes available. The broader lesson is that phone security depends on both the Android platform and the device maker’s components, so a current Android version does not automatically mean every device-specific security issue has been addressed.
How can Pixel owners confirm the phone is protected?
Pixel owners can confirm the phone is protected from the listed September issues by checking that the security patch level is 2026-09-05 or later after installation. The relevant status appears in the device’s security information after the update completes and the Pixel restarts.
Pixel owners should not rely only on an update download notice, because downloaded software can still be waiting for installation or restart. The security patch level is the more meaningful confirmation because Google states that 2026-09-05 or later addresses every vulnerability listed in the September Pixel bulletin.
A phone that remains on an earlier patch level should be checked again through Settings > Security & privacy > System & updates > Security update. Contact Google Pixel support or the carrier if the update remains unavailable after the normal staged rollout period, particularly if the device is eligible for ongoing security support.
Pixel owners should also be cautious with unexpected messages about security problems, because attackers can use real vulnerability news to make fraudulent alerts appear credible. The fake government request incident involving customer records illustrates why a message’s claimed authority is not enough to establish legitimacy. Check for the Pixel patch inside Settings rather than through a link in an email or text message.
FAQ
Is the Pixel modem zero-day being actively exploited?
Yes, Google says there are indications that CVE-2026-58704 may be under limited, targeted exploitation. Google has not publicly identified the targets or described a broad campaign against all Pixel users.
What security patch level fixes CVE-2026-58704?
Security patch level 2026-09-05 or later fixes CVE-2026-58704 and every issue listed in Google’s September 2026 Pixel bulletin. Check the installed patch level after the Pixel restarts.
How do I update a Pixel phone for the modem vulnerability?
Pixel owners can update through Settings > Security & privacy > System & updates > Security update. Download the available update and restart the phone to complete installation.
Why has my Pixel not received the September update?
Pixel updates roll out gradually and can take a few weeks depending on the device and carrier. Check the Security update screen manually until the September patch becomes available.
Does CVE-2026-58704 affect all Android phones?
No, CVE-2026-58704 is listed as a Pixel Modem vulnerability in Google’s Pixel bulletin. Non-Pixel Android users should still install their own manufacturer’s current security updates.