Loading story…
Google's September 2026 Pixel security update fixes 110 vulnerabilities in Pixel-specific hardware and firmware, including CVE-2026-58704, an elevation-of-privilege zero-day in the cellular modem. Google reported indications of limited, targeted exploitation of the flaw. An attacker must already hold basic privileges on the device and likely control cellular-network conditions or operate a rogue base station; the issue is not described as remotely exploitable over the general internet.
The update addresses 46 critical, 62 high-severity, and one moderate vulnerability, including nine remote-code-execution flaws, 88 additional elevation-of-privilege issues, 10 information-disclosure bugs, and two denial-of-service flaws. Pixel owners should install the update promptly, as Android Security Bulletin patches do not fully cover Pixel-specific components such as modems, bootloaders, GPUs, and fingerprint hardware; custom ROM users may remain exposed to underlying firmware and hardware defects.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
The update addressed CVE-2026-58704, a cellular-modem logic-error vulnerability that can enable privilege escalation by bypassing a permission check. Google reported indications of limited targeted exploitation; attacks require existing low-level device access and may involve a compromised cellular network or malicious base station.
Google published details of its September 2026 Pixel security update, remediating 110 vulnerabilities in Pixel-specific hardware and firmware-related components. The fixes included 46 critical, 62 high-severity, and one moderate-severity issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released its September 2026 Pixel security update to fix **CVE-2026-58704**, an actively exploited zero-day in the cellular modem component. Google said exploitation is limited and targeted; the improper-authorization flaw can allow a nearby attacker with basic device privileges to bypass access controls and elevate privileges without user interaction. The update addresses 110 Pixel vulnerabilities overall, including dozens rated critical or high severity. Organizations and users should deploy the `2026-09-05` Android security patch level or later across supported Pixel devices, prioritizing people and fleets at heightened risk of targeted surveillance.
Sep 18, 2026
Google’s September 2026 Android Security Bulletin fixes more than 90 vulnerabilities affecting Android 14, 15, 16, 16 QPR2, and 17. The release rates 26 flaws as **critical** and 68 as high severity, including Android System remote-code-execution vulnerabilities that can be triggered without user interaction or additional execution privileges, depending on the affected CVE. It also addresses critical elevation-of-privilege and denial-of-service issues in the Framework and System, a critical Transparent Inter-Process Communication kernel-component RCE flaw, and defects in kernel, Android TV, and vendor components. Google is distributing patch levels `2026-09-01` and `2026-09-05`; devices at the latter level receive all applicable September fixes, including relevant kernel and vendor patches. Pixel and Samsung Galaxy devices are among the first receiving updates, while availability for other manufacturers may lag. Qualcomm separately released fixes for 14 high-severity vulnerabilities in software used by its mobile, wireless-connectivity, automotive, and computing platforms, which could expose confidential information or disrupt affected services. No active exploitation was reported at publication, but organizations should prioritize deployment of available Android and vendor updates.
Sep 9, 2026
Google released the March 2026 *Android Security Bulletin*, issuing fixes for **129 vulnerabilities** across the Android ecosystem and shipping two patch levels (`2026-03-01` and `2026-03-05`) to help OEMs stage platform and hardware-specific updates. The most urgent issue is **CVE-2026-21385**, a **high-severity, actively exploited** zero-day in an open-source **Qualcomm display** component used in Android devices with affected Qualcomm/Snapdragon chipsets. Reporting indicates CVE-2026-21385 is a **memory-corruption** flaw caused by an **integer overflow/wraparound** condition that can lead to memory corruption during allocation/alignment in display drivers; successful exploitation could enable device compromise (e.g., arbitrary code execution and/or privilege escalation) and bypass security boundaries. Google and Qualcomm both acknowledged **limited, targeted exploitation in the wild**, and one account attributes discovery/confirmation of exploitation to Google’s **Threat Analysis Group (TAG)**; devices not updated to at least patch level `2026-03-05` remain exposed, making rapid patch deployment and user update compliance the primary risk-reduction actions.
Jun 29, 2026