Full Report
CISA gives federal agencies just 3 days to patch
Analysis Summary
# Vulnerability: Google Pixel Modem Zero-Click Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2026-58704
- **CVSS Score:** High Severity (Specific numerical score pending)
- **CWE:** Improper Authorization
## Affected Systems
- **Products:** Google Pixel smartphones.
- **Versions:** All devices running firmware prior to the September 2026 security update.
- **Configurations:** Devices utilizing specific cellular modem components.
## Vulnerability Description
CVE-2026-58704 is an improper authorization vulnerability located within the cellular modem firmware of Google Pixel devices. The flaw allows an attacker to bypass standard permission checks. Because the vulnerability resides at the modem level, it can be triggered without any user interaction ("zero-click"), leading to local privilege escalation.
## Exploitation
- **Status:** **Exploited in the wild.** CISA has added this to the Known Exploited Vulnerabilities (KEV) catalog.
- **Complexity:** Low (Zero-click; no user interaction required).
- **Attack Vector:** Remote/Cellular (Zero-click delivery via modem).
## Impact
- **Confidentiality:** High (Potential access to sensitive data and communications).
- **Integrity:** High (Bypassing permission checks and escalating privileges).
- **Availability:** High (Potential for modem instability or device takeover).
## Remediation
### Patches
- **Google Pixel Update:** Users must apply the **September 2026** (or later) security patch.
- **Federal Agencies:** Per CISA BOD 22-01, federal agencies must apply the update by **September 19, 2026**.
### Workarounds
- There are no known functional workarounds that maintain cellular connectivity. Immediate patching is the only recommended mitigation.
## Detection
- **Indicators of Compromise:** Currently, specific indicators (IoCs) have not been publicly released by Google or CISA due to the "limited, targeted" nature of the exploitation.
- **Detection methods and tools:** Monitor for unusual system privilege requests or unexpected modem crashes. Mobile Device Management (MDM) tools should be used to verify that all fleet devices are on the September 2026 patch level.
## References
- Google Pixel Security Bulletin: [https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01] (Defanged: hxxps[://]source[.]android[.]com/docs/security/bulletin/pixel/2026/2026-09-01)
- CISA Known Exploited Vulnerabilities Catalog: [https://www.cisa.gov/known-exploited-vulnerabilities-catalog] (Defanged: hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog)
- CVE Record: [https://www.cve.org/CVERecord?id=CVE-2026-58704] (Defanged: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-58704)