Google has confirmed in its September Pixel security bulletin that some owners of its phones were hit by targeted attacks. The attackers exploited a previously unknown bug, now patched, which the US National Vulnerability Database lists as CVE‑2026‑58704.
Google has shared few details about the flaw. According to TechCrunch, it sat in the modem — the component that connects the phone to the internet. The bug let attackers break out of the modem’s isolated environment and reach other data on the device. In effect, they gained more control over the system than they should have had, a technique known as privilege escalation.
What makes the attack especially dangerous is that it could work without the victim doing anything. Pixel owners didn’t have to open a file or tap a link. The industry calls this kind of attack zero-click.
Google rolled out the fix as part of the September security update for Pixel. The company usually ships new software to its own phones first — in June, for instance, Pixel devices got Android 17 ahead of everyone else.
Follow Mediasat on Google News: the latest in TV, telecom and tech
Google hasn’t said who was behind the attacks. Experts note that flaws like this are often used by spyware makers, which sell access to their tools to government agencies and law enforcement. Tracking a phone owner doesn’t always take a hack, though. Earlier in September, researchers in Vienna found that delivery receipts in WhatsApp and Signal give away the location of a number’s owner.
