CVE-2026-58704: Google Pixel Cellular Modem Privilege Escalation (KEV)

CVE-2026-58704 is a permission-bypass logic error in the cellular modem firmware of Google Pixel devices that lets a radio-proximate attacker escalate privileges without any user interaction, and Google's own September 2026 Pixel bulletin says it may already be under limited, targeted exploitation.

CVE-2026-58704 is an improper authorization / incorrect privilege assignment (CWE-285, CWE-693) in the cellular modem firmware used by Google Pixel devices. NVD's description states: "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation" — meaning an attacker within radio range of the device's cellular modem, not necessarily reachable over the open internet, can exploit the logic flaw to bypass a permission check and gain elevated privileges without any action from the user (NVD).

The CVSS v3.1 score NVD lists, 8.8 (high), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, is stored as a Secondary metric sourced to CISA's own Authorized Data Publisher (ADP) scoring — it is not Google's own CNA submission and not an NVD Primary score, though the adjacent-network attack vector matches Google's "remote (proximal/adjacent)" description of the bug (NVD).

Google's Android Security Bulletin for Pixel devices, dated September 2026, lists CVE-2026-58704 under the "Modem" component with internal reference A-484011314*, type "EoP" (Elevation of Privilege) and severity "High", and separately states: "There are indications that CVE-2026-58704 may be under limited, targeted exploitation." The asterisk on the bug ID indicates the fix is delivered through binary modem/baseband drivers rather than the AOSP source tree. All supported Pixel devices receive the fix at security patch level 2026-09-05 or later (Android Security Bulletin — Pixel, September 2026).

CISA added CVE-2026-58704 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-16, with a required-action due date of 2026-09-19 (3 days), consistent with Google's own note about limited, targeted exploitation (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.0063 (49.750th percentile) — middling, unsurprising for a bug whose attack vector requires physical or radio proximity to the target device rather than being exploitable over the open internet (FIRST EPSS).

Because exploitation has already been observed in a limited, targeted fashion and the attack needs only radio proximity rather than a prior foothold on the device, every supported Pixel device should be updated to the 2026-09-05 security patch level or later as soon as it is available, with particular urgency for users who could be the target of focused surveillance.

• Permission bypass due to a logic error in the cellular modem (CWE-285/CWE-693) enables adjacent/proximal escalation of privilege with no additional privileges or user interaction required. — NVD
• CVSS v3.1 base score is 8.8 (high), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, sourced to CISA's Authorized Data Publisher (ADP) scoring and stored by NVD as a Secondary metric (not Google's own CNA submission). — NVD
• Android Security Bulletin (Pixel, September 2026) lists the bug under the Modem component (ref A-484011314*, type EoP, severity High), states it "may be under limited, targeted exploitation," and fixes it at security patch level 2026-09-05. — Android Security Bulletin — Pixel, September 2026
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-16, required action due 2026-09-19. — CISA KEV
• EPSS score is 0.0063 (49.750th percentile) as of 2026-10-27. — FIRST EPSS