{"id":"google-pixel-modem-zero-day-sep-2026","category":"patch","status":"live","title":"Google Pixel modem zero-day CVE-2026-58704 fixed; wider device patch coverage unclear","tldr":"Google fixed an exploited Pixel modem flaw that needs no user interaction or prior privileges. Install the latest Pixel update and check for security patch level 2026-09-05 or later. Fix coverage for other devices using affected Samsung chips is unconfirmed.","summary":"Google disclosed CVE-2026-58704 on 15 September, warning of indications of limited, targeted exploitation. A logic error in the cellular modem can let a nearby attacker bypass permission checks and gain greater privileges without user interaction or existing privileges. Google rates it high severity and says Pixel security patch level 2026-09-05 or later addresses it. CISA confirmed exploitation by adding it to its catalogue the following day. The attackers and victim numbers have not been publicly identified in the sources reviewed. Samsung also lists affected Exynos processors and standalone modems in an advisory carrying a 23 September report date, but provides no fixed firmware versions or affected handset list. As at 3 November, Pixel remediation is documented; fix coverage across other devices using those chips remains unconfirmed.","action":"On a Pixel, open Settings → System → Software update and install the latest update; check that the Android security update date is 5 September 2026 or later. For another device using an affected Samsung chip, ask its manufacturer whether its firmware fixes CVE-2026-58704.","product":"Google Pixel phones and Samsung Exynos cellular modems","audience":"home","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2026-58704"],"tags":["google","pixel","android","samsung","modem","zero-day"],"affected":["Google Pixel modem component; Google does not identify individual affected models in its bulletin","Samsung Exynos 850, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, 9110, W920, W930 and W1000 — EMM component","Samsung Modem 5123, 5300, 5400 and 5410 — EMM component"],"fixed":["Google Pixel security patch level 2026-09-05 or later"],"matches":[{"platform":"android","app":"Google Pixel","bundle":"","fixed":"2026-09-05"}],"sources":[{"kind":"advisory","title":"Pixel Update Bulletin—September 2026","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01","by":"Google","date":"2026-09-15"},{"kind":"advisory","title":"CVE-2026-58704","url":"https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2026-58704/","by":"Samsung Semiconductor","date":""},{"kind":"advisory","title":"CISA Known Exploited Vulnerability Entry: CVE-2026-58704","url":"https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/993d6267-11c4-4484-beb6-8a8ad8acfea8","by":"CIRCL, reproducing CISA","date":"2026-09-16"},{"kind":"advisory","title":"CVE-2026-58704: Google CVE record and CISA assessment","url":"https://vulnerability.circl.lu/vuln/CVE-2026-58704","by":"CIRCL, reproducing Google and CISA","date":"2026-09-16"},{"kind":"news","title":"Google confirms Pixel phones were exploited in ‘targeted’ attack related to modem","url":"https://9to5google.com/2026/09/16/google-pixel-targeted-zero-day-modem-attack/","by":"9to5Google","date":"2026-09-16"},{"kind":"news","title":"Google says some Pixel phone owners were hacked in zero-day attacks","url":"https://techcrunch.com/2026/09/16/google-says-some-pixel-phone-owners-were-hacked-in-zero-day-attacks/","by":"TechCrunch","date":"2026-09-16"},{"kind":"advisory","title":"Learn when you'll get software updates on Google Pixel phones","url":"https://support.google.com/pixelphone/answer/4457705","by":"Google","date":""}],"started":"2026-09-15","closed":null,"created":"2026-11-03T21:05:31.443Z","updated":"2026-11-03T21:05:31.443Z","cve_notes":[{"cve":"CVE-2026-58704","name":"Permission bypass in Pixel and Exynos cellular modems","what":"A logic error in the cellular modem's permission checks can let an attacker on an adjacent network gain greater privileges without existing privileges or interaction from the owner.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-09-23","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Samsung's advisory records this as the report date and lists affected Exynos processors and standalone modems. It supplies no fixed firmware versions or device-level update list, leaving patch coverage beyond Pixel unconfirmed.","url":"https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2026-58704/","by":"Samsung Semiconductor","patch":"partial"},{"at":"2026-09-16","added":"2026-11-03T20:51:54.186Z","kind":"cisa-added","text":"CISA added the flaw to its Known Exploited Vulnerabilities catalogue, confirming its use in attacks. Its entry, reproduced by CIRCL, set a 19 September remediation deadline.","url":"https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/993d6267-11c4-4484-beb6-8a8ad8acfea8","by":"CIRCL, reproducing CISA","patch":null},{"at":"2026-09-15","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"Google disclosed high-severity modem flaw CVE-2026-58704 and signs of limited, targeted exploitation. Pixel security patch level 2026-09-05 or later fixes it.","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01","by":"Google","patch":"patched"}],"url":"https://hard.fyi/live/google-pixel-modem-zero-day-sep-2026/","json":"https://hard.fyi/api/live?id=google-pixel-modem-zero-day-sep-2026"}