Google Pixel Cellular Modem Authorization Bypass (CVE-2026-58704)

A logic error in the Google Pixel cellular modem firmware has exposed devices to CVE-2026-58704, a high-severity Google Pixel improper authorization vulnerability carrying a CVSS score of 8.8. The flaw allows an unauthenticated attacker within radio range to bypass permission checks and escalate privileges directly on the modem processor. Because the issue resides deep within the cellular stack, exploitation requires no prior access or user interaction.

Analyzing CVE-2026-58704 in Cellular Modems

Cellular basebands operate as semi-autonomous systems running real-time operating systems alongside the main Android OS. When a modem fails to enforce proper access controls (CWE-285) or protection mechanisms (CWE-693), the boundary between untrusted cellular signaling and privileged internal functions breaks down.

The vulnerability’s vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) defines a distinct physical attack vector. The adjacent network rating (AV:A) means an attacker must be within localized radio range—typically operating a software-defined radio (SDR), a false base station (FBS), or a malicious local wireless access node—to interact with the vulnerable baseband stack. Because the attack complexity is low (AC:L) and requires no privileges (PR:N) or user interaction (UI:N), a successfully crafted signal frame can compromise the modem without any visible indicator on the device screen.

Despite the severe impact across confidentiality, integrity, and availability, the vulnerability registers an EPSS score of 0.11% (1.6th percentile). Baseband vulnerabilities rarely see opportunistic, mass-automated exploitation across the public internet because generating the attack traffic requires localized radio frequency (RF) equipment rather than simple HTTP packets. Instead, this vulnerability class is primarily valuable to sophisticated actors performing targeted physical surveillance, tactical signal interception, or localized intelligence gathering against specific high-value devices.

Operational Exposure and Risk Profile

Organizations deploying Google Pixel handsets in high-security, field-mobile, or government environments face the primary exposure. An attacker who successfully escalates privileges within the cellular modem can potentially intercept over-the-air data traffic, manipulate baseband memory, or trigger denial-of-service conditions on the device’s primary WAN interface.

Because the main operating system relies on modem integrity for secure network communications, compromise at the modem layer circumvents traditional application-level security controls without alerting enterprise monitoring software.

Patching and Remediation Strategy

Enterprises and system administrators managing affected mobile fleets should execute the following actions:

• Deploy System Updates: Update all managed Google Pixel devices to the latest firmware release incorporating Google’s vendor mitigations.
• Enforce BOD 26-04 Compliance: Ensure institutional compliance with CISA BOD 26-04 mitigation mandates before the September 19, 2026 deadline. Mobile management teams should mandate device compliance checks via Enterprise Mobility Management (EMM) solutions and isolate non-compliant hardware from internal corporate networks.
• Forensic Triage: For high-value assets suspected of having operated near untrusted or hostile RF environments (such as international transit hubs or unmonitored physical sites), conduct mobile device forensic triage according to standard operational procedures before applying updates and returning devices to service.