{"id":"CVE-2026-58704","kind":"vulnerability","aliases":["CVE-2026-58704"],"related":[],"title":"google android: In Cellular Modem, there is a possible permission bypass due to a logic error in the code","description":"Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Google Pixel phones contain an improper authorization flaw in the cellular modem where a logic error lets an attacker bypass permission checks. A successful attacker can escalate privileges on the device, and CISA lists it as exploited in the wild.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2026-09-16T00:00:00+00:00","products":[{"name":"Google Pixel","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"google android","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","cellular-modem","exploited","mobile-fleet","pixel","vendor"],"not_affected_if":["fully-patched-devices","non-pixel-devices"],"how_to_check":"Check the Pixel's Android security patch level under Settings > About phone; compare it against Google's Pixel security bulletin for CVE-2026-58704 (unknown whether a specific patch level is listed in the sources).\nAn MDM or fleet tool reporting the security patch date can show which devices are behind.","fix":"Install the latest Google Pixel security update that addresses CVE-2026-58704 (exact patch level unknown from the sources).\nIf no update is available, follow CISA BOD 26-04 guidance or stop using the affected devices for sensitive work.","status":"open","published_at":"2026-09-15T19:17:32+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:29+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:31:29Z","model":"claude-haiku-5-5","output":{"fix":"Install the latest Google Pixel security update that addresses CVE-2026-58704 (exact patch level unknown from the sources).\nIf no update is available, follow CISA BOD 26-04 guidance or stop using the affected devices for sensitive work.","summary":"Google Pixel phones contain an improper authorization flaw in the cellular modem where a logic error lets an attacker bypass permission checks. A successful attacker can escalate privileges on the device, and CISA lists it as exploited in the wild.","category":"vendor","who_cares":["pixel","android","mobile-fleet","cellular-modem"],"confidence":0.6,"analyst_note":"Sources do not name affected or fixed Pixel models or the fixed security patch level; check Google's Pixel security bulletin and the CISA KEV entry for the exact patch date and CISA's required action deadline.","how_to_check":"Check the Pixel's Android security patch level under Settings > About phone; compare it against Google's Pixel security bulletin for CVE-2026-58704 (unknown whether a specific patch level is listed in the sources).\nAn MDM or fleet tool reporting the security patch date can show which devices are behind.","needs_analyst":true,"not_affected_if":["non-pixel-devices","fully-patched-devices"],"severity_if_unknown":"high"},"cost_usd":0.000445,"input_tokens":2188,"output_tokens":453,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':123C,149C,180C '-2026':21A,24A '-58704':22A,25A '26':122C,148C,179C 'accord':112C 'action':108C 'adher':176C 'allow':96C 'android':2A,29A,30B 'appli':109C 'applic':146C 'asset':170C 'attack':58B,64B,98C 'author':46B,86C 'base':127C 'bod':121C,147C,178C 'bypass':11A,59B,100C 'cellular':4A,32B,50B,90C 'cellular-modem':31B 'check':61B,102C 'cisa':72B,106C,119C,136C 'cloud':152C 'code':19A 'complianc':117C 'contain':43B,83C 'cve':20A,23A 'devic':70B,82C 'discontinu':155C 'due':12A 'ensur':116C,175C 'error':16A,55B,94C 'escal':66B,104C 'evalu':168C 'exploit':34B,76B 'exposur':173C 'flaw':47B 'fleet':37B 'follow':145C 'forens':138C 'googl':1A,40B,80C 'google':26A,28A 'guidanc':134C,150C 'guidelin':182C 'improp':45B,85C 'instruct':115C 'internet':172C 'let':56B 'list':73B 'logic':15A,54B,93C 'may':95C 'mitig':110C,161C 'mobil':36B 'mobile-fleet':35B 'modem':5A,33B,51B,91C 'note':133C,144C 'patch':181C 'permiss':10A,60B,101C 'phone':42B 'pixel':27A,38B,41B,81C 'possibl':9A 'priorit':124C 'privileg':67B,105C 'product':159C 'requir':107C,140C 'respons':166C 'risk':129C 'secur':125C 'see':130C,141C 'servic':153C 'stakehold':164C 'success':63B 'triag':139C 'unavail':163C 'updat':126C 'url':131C,142C 'use':156C 'vendor':39B,114C 'vulner':87C 'wild':79B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-15T19:17:32+00:00","kev":{"dateAdded":"2026-09-16","dueDate":"2026-09-19","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-58704","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58704","severity":null,"published_at":"2026-09-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:13+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-58704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58704","severity":null,"published_at":"2026-09-15T19:17:32+00:00","modified_at":"2026-10-07T19:17:39+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}