512/69 Thursday, September 17, 2026
Google has released its September 2026 security update for Pixel devices, addressing a total of 110 vulnerabilities. Among them is one zero-day vulnerability that has reportedly been exploited in limited, targeted attacks. The vulnerability is tracked as CVE-2026-58704, and Google stated that exploitation of the flaw has been observed. The company recommends that all supported Google devices install the update to the September 5, 2026 patch level as soon as possible.
CVE-2026-58704 is a high-severity vulnerability related to improper authorization and protection mechanism failure in the modem component. It stems from a logic error in the cellular modem code that may allow permission bypass. If successfully exploited, an attacker on a nearby or short-range connected network, with basic privileges on the target device, may be able to escalate privileges without requiring user interaction or additional execution privileges.
In addition to the zero-day vulnerability, this update fixes 109 other vulnerabilities in Pixel devices, including 12 remote code execution vulnerabilities and 89 privilege escalation vulnerabilities rated Critical or High severity. Although Pixel devices run Android like devices from other manufacturers, they receive separate security updates and bug fixes because Google directly controls Pixel-specific hardware platforms and features. Users can install the update by going to Settings > Security & privacy > System & updates > Security update, then selecting Install and restarting the device to complete the update.