CVE-2026-58704: Google Pixel Cellular Modem Improper Authorization Enables Privilege Escalation

Background

Google Pixel devices run a cellular modem subsystem — typically implemented as a combination of baseband firmware and a privileged Android system service that mediates access to modem functions such as call handling, SMS, and radio configuration. Because the modem subsystem interfaces directly with the cellular network and handles sensitive telephony operations, Android’s security model places strict permission boundaries around which processes and privilege levels can issue commands to it.

CVE-2026-58704 is an improper authorization vulnerability in that cellular modem component. According to Google’s description, a logic error in the authorization logic may allow an attacker to bypass the permission checks that normally gate access to modem functionality, and in doing so escalate their privileges on the device.

Technical Mechanism

CVE-2026-58704 is classified under CWE-693 (Protection Mechanism Failure), the parent category for vulnerabilities where a security control exists but fails to function as intended. In this case, the specific failure is an improper authorization check (closely related to CWE-285, Improper Authorization) within the modem’s privilege-gating logic.

The reported mechanism is a logic error: rather than a classic memory-corruption bug, this is a flaw in the decision logic that determines whether a calling process is permitted to invoke a given modem operation. A typical exploitation pattern for this class of vulnerability looks like:

1. A malicious or compromised application (or a lower-privileged system component) on the device issues a request to the modem subsystem’s interface — for example, via an inter-process communication (IPC) call, a vendor HAL (Hardware Abstraction Layer) interface, or a radio interface layer (RIL) command.
2. The modem authorization logic evaluates whether the caller holds the required permission or privilege level to perform the requested operation. Due to the logic error, this check either evaluates incorrectly for certain crafted inputs, call sequences, or caller contexts, or can be bypassed entirely by a specific sequence of operations.
3. The modem subsystem executes the requested privileged operation despite the caller lacking legitimate authorization.
4. Because the modem subsystem itself typically runs with elevated system or radio-privileged status, successful exploitation grants the attacker’s process a privilege level it was not entitled to — privilege escalation on the device.

Google’s own description is intentionally general (“a logic error may allow an attacker to bypass permission checks and escalate privileges”), consistent with Android Security Bulletin practice of withholding granular exploit mechanics for actively or recently exploited bugs to limit copycat exploitation before patch adoption is widespread.

Real-World Exploitation Evidence

CISA added CVE-2026-58704 to the Known Exploited Vulnerabilities catalog on 16 September 2026, confirming — by definition of KEV inclusion — that CISA has evidence of active exploitation in the wild, not merely theoretical risk.

No specific threat actor, campaign name, or intrusion set is included in the available KEV data for this entry. No specific threat actor has been publicly attributed to exploitation of this CVE; its KEV listing confirms active exploitation in the wild, but attribution detail is not yet public. Baseband and modem-level privilege escalation bugs on Android devices have historically been associated with targeted surveillance tooling and commercial spyware vendors, given the sophistication typically required to reach and exploit modem-adjacent attack surface — but no such attribution has been confirmed for this specific CVE, and that association should not be assumed without public confirmation.

The knownRansomwareCampaignUse field for this entry is marked “Unknown” — CISA has not confirmed ransomware use of this CVE at this time. Ransomware use of a single-device mobile privilege-escalation bug would, in any case, be an atypical use case for this vulnerability class.

Impact Assessment

Privilege escalation in a device’s modem subsystem has outsized impact relative to a typical application-level privilege escalation bug, because of what the modem subsystem can touch:

• Confidentiality: Elevated access to the modem can expose SMS content, call metadata and content, and potentially IMSI/location-adjacent radio information — data categories that sit outside the reach of the Android application sandbox by design.
• Integrity: An attacker with modem-level privilege may be able to manipulate call routing, SMS delivery, or radio configuration — a concern not just for the device owner’s privacy but for integrity of SMS-based authentication (OTP) flows that many services still rely on.
• Availability: Modem subsystem manipulation can also be used to disrupt cellular connectivity entirely, denying the device owner voice, SMS, or data service.
• Escalation chain risk: On its own, this vulnerability escalates privilege within the device; combined with a separate initial-access bug (a malicious app installed through sideloading, or a separate browser/app sandbox escape), it provides a path from low-privilege code execution to deep system-level control over telephony functions.

Sector-specific risk: This is a consumer/enterprise mobile device vulnerability rather than a server-side or network-infrastructure flaw, so impact is concentrated wherever Pixel devices are used for sensitive communications — executives, journalists, government personnel, and enterprise BYOD fleets carrying Pixel hardware are the highest-value targets for this class of bug, consistent with the historical targeting pattern for modem-level Android vulnerabilities.

Affected Versions

Google’s Android Security Bulletin for Pixel devices (linked below) is the authoritative source for the exact affected device models and firmware/patch levels. Organizations and individuals should consult it directly. In general terms:

Any Pixel device that has not received the September 2026 security update should be treated as presumptively vulnerable.

Remediation Steps

CISA’s required action directs organizations to apply vendor mitigations per BOD 26-04 guidance, follow Forensics Triage Requirements, or discontinue use of the product if mitigations are unavailable.

1. Check the current security patch level on affected Pixel devices:

Settings → System → System update → Security update, or via ADB:

adb shell getprop ro.build.version.security_patch

2. Apply the September 2026 Pixel security update through standard over-the-air update mechanisms, or enforce it via Mobile Device Management (MDM) policy for enterprise-managed fleets.

3. For enterprise fleets, use MDM compliance policies to flag and quarantine (restrict corporate resource access for) devices that have not applied the update within the organization’s patch SLA.

4. Review mobile application allowlisting policies — since exploitation of this class of bug typically requires a malicious or compromised app already running on the device, minimizing sideloading and enforcing Google Play Protect / managed app catalogs reduces the practical attack surface even before patching completes.

5. For high-risk individuals (executives, journalists, government personnel) who may be specifically targeted, prioritize immediate patching over routine update cadence given the confirmed active exploitation.

Detection Guidance

Exact IOCs and detection signatures for this CVE have not been publicly disclosed by Google, and mobile EDR/MTD (Mobile Threat Defense) vendor signatures should be consulted for precise detection content. General guidance:

• Mobile Threat Defense (MTD) tooling: Enterprises with MDM/MTD deployed on Pixel fleets should ensure modem/baseband anomaly detection rules (where supported by the MTD vendor) are enabled and alerting.
• Unusual telephony behavior: Unexplained SMS activity, unexpected call forwarding configuration changes, or anomalous data usage patterns on a device can indicate post-exploitation abuse of modem-level access.
• Patch compliance auditing: Given the lack of public technical IOCs, the most actionable detection control available to most organizations is patch-level compliance auditing — treating any unpatched device as a confirmed exposure requiring investigation if it exhibits anomalous telephony behavior.
• Forensic triage: Per CISA’s referenced Forensics Triage Requirements, organizations with devices that were unpatched during the exploitation window should consider forensic review of device logs rather than relying solely on patching going forward.

Timeline

References

• Android Security Bulletin — Pixel Update Bulletin, September 2026
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA — BOD 26-04 Implementation Guidance: Forensics Triage Requirements
• NVD — CVE-2026-58704