Google patches Pixel zero-click flaw: exploited in targeted attacks

Google has pushed its September 2026 security update to Pixel phones. Included in it is a fix for CVE-2026-58704, a previously unknown zero-day in the modem that, according to Google, was used in “limited, targeted” attacks before a patch was ready.

The flaw was in the Pixel modem. Google says a successful exploit could let an attacker break out of the modem sandbox and reach more sensitive parts of the device. That’s a bad place for a bug to sit. Modem vulnerabilities live close to the phone’s communications stack, so they can put calls, messages, location data, and other stored information at risk.

Google fixed CVE-2026-58704 along with 109 other vulnerabilities in the same update. What makes this one especially serious is that the disclosure describes it as zero-click, meaning an attack could work without you tapping a link, downloading a file, or doing anything at all.

Google hasn’t shared technical details, listed the affected Pixel models, identified the attackers, or said who was targeted. That’s typical when an exploit has already been used in the wild. The disclosure also comes after earlier Pixel zero-days in June 2024 and April 2024 that researchers tied to forensic data extraction.

If you use a Google Pixel regularly, install this update soon. Zero-click, spyware-style bugs are still a real threat, even if Pixel phones remain some of the safer Android options because Google ships patches quickly and promises at least five years of security updates.

You can download the update now from the system update section in your Pixel phone’s settings.