Pixel security update addresses modem flaw under targeted attack

Google published its September Pixel security bulletin on 15 September, flagging indications that CVE-2026-58704 might be under limited, targeted exploitation. The official bulletin classifies the modem issue as a high-severity elevation-of-privilege vulnerability.

The wording is narrower than a claim of widespread compromise. Google did not name the actor, explain the targets’ identities or provide a victim count. The bulletin also lists other vulnerabilities, including critical issues, without extending the targeted-exploitation statement to all of them.

For supported Google devices, the bulletin says a security patch level of 2026-09-05 or later addresses the issues listed in both the Pixel bulletin and September’s Android security bulletin. Google said all supported devices would receive the update and encouraged customers to accept it.

The security patch level is distinct from the bulletin’s publication date. A September-labelled update is not enough information on its own: the device’s installed patch level is the relevant status to check. The advisory covers supported Pixel devices.