Google has warned that a flaw in the modem component of Pixel devices may be under limited, targeted exploitation. Its September 15 security bulletin identifies the issue as CVE-2026-58704 and says the 2026-09-05 security patch level or later addresses the bulletin’s fixes on supported Google devices. The useful check is the phone’s Android security update date—not simply whether it has Android 17 or recently installed an app update.
A modem flaw, with a narrow public account of the attacks
Google lists CVE-2026-58704 as a high-severity elevation-of-privilege issue in the modem. In plain language, this is a weakness that can let an attacker gain permissions beyond those they should have in the affected component. The exploitation warning makes this more urgent than a routine list of theoretical vulnerabilities.
The bulletin does not identify victims, an attacker group, the attack dates, or the full chain used against a phone. It also does not establish that every Pixel owner was targeted. Those gaps matter: the appropriate response is to install the vendor’s fix, without treating ordinary battery drain or a slow phone as evidence of this particular attack.
September 15 is the announcement; September 5 is the patch level
The dates describe different things. Google published this Pixel bulletin on September 15, but names September 5, 2026 as the security patch level covering its issues. The bulletin includes both Pixel-specific fixes and the September Android security fixes. “I updated in September” is therefore less useful than checking the actual field on the device.
Open Settings → About phone → Android version and read Android security update. Google shows the Android version, Android security update, Google Play system update, and build number as separate entries. A recent Google Play system update date is not the Android security patch date specified in this bulletin.
Install the update, restart, then check the date again
- Open Settings → System → Software updates. On some Pixels the entry is called System update. Follow the device’s update instructions.
- Let installation finish and restart. Google says downloaded Pixel system updates become active on the next restart.
- Return to Android security update and check for September 5, 2026 or later. If the device still shows an earlier date, that screen does not yet confirm the bulletin’s stated patch level.
Google says update schedules vary by device and carrier. If no newer update is offered, use the device’s official update and support route; the bulletin is not a reason to install firmware or an APK from an unsolicited message. For a separate concern about suspicious apps or behavior, our phone virus signs and safe checks guide helps distinguish symptoms from evidence of infection.
The immediate task is small: install the available official system update, restart, and verify the correct date. A patched device closes the vulnerability addressed by the update; the date alone cannot reconstruct whether an earlier compromise occurred.
References
- Google. “Pixel Update Bulletin—September 2026.” Android Open Source Project, September 15, 2026. Pixel security bulletin.
- Google. “Check & update your Android version.” Pixel Phone Help, accessed September 17, 2026. Official update instructions.
