Google has released the September 2026 security update for supported Pixel phones. The company said the high-severity CVE-2026-58704 privilege escalation vulnerability in the modem component may be exploited in limited, targeted attacks; it did not provide details about the scope of the attacks or the affected models.
Users need to update their devices to the 2026-09-05 security patch level or later. The update status can be checked in the settings; after installation and a restart, the security patch date can be verified.
Why it matters
The indication that the vulnerability may be exploited in attacks makes the update more than a routine monthly maintenance task. While the privilege escalation risk in the modem component directly concerns users of supported Pixel devices, the reference to limited and targeted attacks does not mean that all devices are being widely targeted. Google’s failure to disclose the scope of the attacks leaves unanswered questions about which users face a higher risk and how the attacks are being carried out. The lack of information about the affected models also prevents users with supported devices from determining the risk level specific to their own devices based on official information. Verifying the patch date after installation makes it possible to confirm that the fix has actually been applied to the device.
Background
Google is not a new name in the FikirPilot archive: over the past 90 days, we published 39 news reports mentioning this name; the latest was dated 17 September 2026.
Term: patch
A patch is an update that fixes a bug or security vulnerability in software.