Google Patches Pixel Modem Privilege Escalation Flaw Under Active Exploitation

Wed, 16 Sep 2026 15:25:29 +0000

Engineer — Plan: CISA KEV listing and public PoC elevate urgency beyond routine patching; if your organization issues corporate Pixel devices, verify your MDM is enforcing the September 2026 security update to CVE-2026-58704’s fixed build level.
SOC/IR — Plan: Limited targeted exploitation means a sophisticated actor is actively using this; if corporate Pixel devices are in scope, confirm MDM patch compliance and add coverage for post-exploitation behaviors (unexpected privilege changes on Android endpoints) since modem-level compromise offers minimal traditional SIEM visibility.
Leader — Plan: CISA KEV designation confirms real-world targeted use; verify the corporate mobile fleet’s MDM enrollment and patch push status for September 2026 Android security updates, and note this aligns with elevated nation-state mobile targeting trends worth tracking on the risk register.
Signals: CVE-2026-58704 — CISA KEV: listed, EPSS 0.00, public PoC on GitHub

Pixel-Android on CuraSec