ZeroDayAlert

CVE-2026-58704: Google Pixel Improper Authorization Vulnerability

Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.

Google Pixel Added to KEV 2026-09-16 Federal due 2026-09-19 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Google Pixel devices running vulnerable versions of the cellular modem firmware are affected. The vulnerability exists in the modem's authorization logic rather than the main operating system, meaning it may persist even after an Android security update. The record does not specify which Pixel model generations, Android versions, or modem firmware versions contain this flaw.

How to check whether this touches you

  • Inventory all Pixel devices in your organisation and their assigned users or locations.
  • Establish whether each device connects to cellular networks (rather than WiFi-only), since the vulnerability is specific to the modem.
  • Cross-reference device model and current Android/modem firmware version against Google's security bulletin for CVE-2026-58704 to confirm whether your version is listed as vulnerable; note that carriers and manufacturers sometimes backport fixes, so version alone is a signal, not proof of exposure.
  • If devices are managed via MDM (Mobile Device Management), query the console to filter by model and firmware version at scale.
  • For BYOD or personal devices, request users to check their device settings and report back.

What to do

  1. Obtain Google's mitigation guidance immediately. Consult Google's security advisory for CVE-2026-58704 to confirm the required firmware or Android version, the rollout schedule, and whether your carrier is delivering updates.
  2. Prioritise patching under BOD 26-04 timelines. CISA has set a federal remediation due date of 2026-09-19; align your internal patching schedule with that deadline, treating Pixel devices as high-priority if they are internet-facing or handle sensitive data.
  3. If patching cannot be completed by the deadline, reduce exposure by disabling cellular connectivity on vulnerable devices where feasible, restricting their use to WiFi networks only, or removing them from high-trust network segments.
  4. Enable logging on managed devices. If your MDM or security tools offer modem-level event logging, enable it to capture any anomalous permission or privilege escalation attempts.
  5. Plan for retrospective forensics. Given the authorisation bypass nature of this flaw, assume exploitation may have occurred before public disclosure; flag affected devices for forensics triage if they have accessed sensitive systems or data.
  6. Escalate to security leadership if you cannot patch all vulnerable devices by 2026-09-19 or if any affected device has been exposed to untrusted networks.

If you find you were exposed

Exploitation of an authorization bypass in the cellular modem is difficult to detect from the main device logs, since the attacker would be operating at the modem firmware level. Request that any device suspected of compromise be forensically triaged by a specialist with access to modem logs and memory, prioritising devices that have handled high-value credentials or connected to critical systems. Log retention is your main constraint; ensure you have preserved device logs and network access records for at least 90 days before the vulnerability was public, in case incident response later requires historical reconstruction.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-58704 is being exploited. It cannot tell you whether Pixel is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →