Google Pixel Improper Authorization Vulnerability
This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Pixel, fix it now.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
US federal civilian agencies must remediate by Sep 19, 2026.
No official fix confirmed yet
Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.
| Product | Vendor | Affected versions | Source |
|---|---|---|---|
| Android | all versions | NVD | |
| Pixel | — | KEV |
Sources: NVD = NIST National Vulnerability Database; KEV = CISA Known Exploited Vulnerabilities catalog.
Developments from the last 30 days, newest first.
CVE-2026-58704 scored CVSS 8.8: Google Pixel, Google Pixel Improper Authorization Vulnerability
CISA lists this as exploited in the wild. Unpatched Pixel systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database
CVE-2026-58704 added to CISA KEV: Google Pixel, Google Pixel Improper Authorization Vulnerability
CISA lists this as exploited in the wild. Unpatched Pixel systems are exposed to active attacks now.
Basis: CISA Known Exploited Vulnerabilities catalog
CISA lists this as exploited in the wild. Unpatched Pixel systems are exposed to active attacks now.
Apply the vendor's security update for Pixel.
