Google on Tuesday informed Pixel phone owners that it has patched a zero-day vulnerability exploited in targeted attacks.
The zero-day is tracked as CVE-2026-58704, and Google said it’s aware of “limited, targeted exploitation”.
The vulnerability has been rated high severity and affects the Pixel’s modem component.
“In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation,” reads the CVE record for CVE-2026-58704.
Google has not attributed the exploitation to a specific threat actor, but the modem-level, zero-click nature of the flaw and the company’s ‘limited, targeted’ framing are hallmarks of past attacks linked to commercial spyware vendors or state-sponsored actors.
The latest Pixel updates also include the most recent Android security patches. They also resolve more than 100 other vulnerabilities that are specific to Pixel devices.