Pixel Modem Flaw: Check Your September Security Update

Google published its September Pixel Update Bulletin on 15 September. The following day, CISA added CVE-2026-58704 to its Known Exploited Vulnerabilities catalogue. That is a concrete reason to prioritise the update rather than treat it as routine feature maintenance.

Google classifies this specific issue as high-severity elevation of privilege in the modem. The NVD record, sourced to Google Devices, describes a permission bypass caused by a logic error in the cellular modem. It says exploitation can lead to remote, proximal or adjacent privilege escalation without additional execution privileges or user interaction.

Those qualifications matter. This is not a claim that anyone on the public internet can take over every Pixel, nor does the catalogue entry tell an individual owner whether their phone was targeted. The sources do not provide a victim count or identify an attacker. Other flaws in the bulletin have different impacts; their critical ratings should not be attached to this CVE.

Google says security patch levels of 2026-09-05 or later address all issues in the September Pixel bulletin and the September Android Security Bulletin on Google devices. The date is a patch-level label, not the bulletin's publication date. A recent app update or a familiar Android version number is not evidence that this modem fix is installed.

Open Settings, then System, then Software update, following Google's Pixel help instructions. Install the offered update and complete any restart requested. Afterwards, check the Android security update level in Settings and confirm it is 2026-09-05 or later.

Google says updates roll out gradually and depend on the device and carrier. If the expected update is not yet offered, check again through Settings or use official Pixel support rather than downloading a supposed emergency patch from a message or advert. On a work-managed phone, ask the IT team about the approved update process.

The bulletin promises updates for supported Google devices; it is not a promise that every Pixel ever sold will receive this patch. Google's support page lists Pixel 5a and earlier models as no longer receiving Android-version or security updates. Check your exact model's support status if no update appears.

If a device is outside security support, a VPN subscription is not a substitute for missing firmware fixes. Plan a move to a supported device, especially for sensitive accounts. The modem notice alone is not evidence that you need to reset every password or erase a phone that shows no other sign of compromise.

A consumer VPN protects supported IP traffic between the phone and the VPN server. It does not replace the modem software that handles cellular communication or correct its permission checks. Staying off public Wi-Fi is not an equivalent mitigation for a cellular-modem flaw either.

Our explanation of what a VPN hides covers that network boundary. The earlier Android VPN-leak article concerns a separate traffic-routing issue: keeping a VPN configured correctly and keeping the operating system patched are complementary tasks, not interchangeable fixes.