CVE-2026-58704: Google Pixel Improper Authorization Vulnerability

CVE-2026-58704 is an improper authorization vulnerability affecting Google Pixel devices in the cellular modem. A logic error can allow an attacker to bypass permission checks and escalate privileges on the device. For IT and security teams managing Pixel fleets, this matters because modem-level privilege escalation can undermine device integrity, access controls, and the trust boundary between radio firmware and the rest of the platform. Confirm exact scope, fixed builds, and deployment guidance against the vendor advisory before acting.

CISA characterizes the issue as improper authorization in the cellular modem and directs organizations to apply mitigations per vendor instructions while aligning with BOD 26-04 risk-based update prioritization and related forensics triage expectations. Ransomware use is not documented for this CVE in the provided facts.

How it works

The weakness is tracked as CWE-693 (Protection Mechanism Failure): a security control that should enforce authorization does not operate as intended. On Google Pixel devices, the flaw sits in the cellular modem. Public detail describes a logic error that may let an attacker bypass permission checks and escalate privileges.

In practical terms for this class of issue, an adversary who can interact with the affected modem path—through local code, a malicious app with partial access, or other attack surface that reaches the modem stack—may obtain privileges the design intended to deny. Exact preconditions, required access level, and exploitation steps are not provided here; treat any deeper technical narrative as speculative until the vendor advisory and your own lab validation confirm them. Do not assume remote wormability or specific payload formats without vendor confirmation.

Am I affected? How to find it in your systems

Google Pixel phones and related Pixel hardware that include the cellular modem are the stated affected product class. Inventory every Pixel device in corporate, BYOD, and lab environments: MDM/EMM enrollment lists, mobile device management reports, asset databases, carrier and eSIM records, and physical checks for unmanaged handsets used for work email, MFA, or VPN.

• Record model, OS build, security patch level, and modem/baseband related identifiers your MDM or Settings → About phone (and carrier/modem detail screens) expose; compare those values only to the fixed versions named in the Google/Pixel vendor advisory.
• Flag devices that lag behind the vendor’s recommended security update channel, are sideloaded, rooted/unlocked in ways that complicate official OTA, or sit outside MDM control.
• Review whether devices process sensitive corporate data, hold privileged app certificates, or are used as second factors.

Telemetry signs of exploitation for modem authorization bypasses are often subtle. Watch for unexpected privilege or capability changes, anomalous modem or radio-related crashes, unusual baseband behavior, sudden policy or permission anomalies reported by endpoint or mobile threat defense tools, and indicators the vendor or CISA may publish later. Confirm any IoCs against official advisories rather than generic modem noise. If compromise is suspected, follow your incident process and CISA forensics triage expectations referenced in the required action.

How to remediate

Patch first. Apply the vendor security update or mitigation package that addresses CVE-2026-58704 on all affected Google Pixel devices, following Google’s official Pixel/security bulletin instructions. Validate successful installation via MDM compliance reports or on-device build/patch strings, then re-check against the advisory’s fixed versions.

• Prioritize internet-exposed or high-value users (executives, admins, developers with production access) in line with BOD 26-04 risk-based prioritization.
• Enforce a minimum security patch level in MDM; quarantine or network-restrict non-compliant Pixels.
• After patching, re-verify modem-related settings and enterprise policies were not weakened during update.
• If mitigations are unavailable for a given asset, CISA’s required action includes discontinuing use of the product where appropriate and evaluating internet exposure.

Hardening for this class: keep Pixel devices on supported update tracks, limit sideloading and unnecessary privileged apps, use strong device encryption and screen locks, and restrict modem-adjacent debugging or engineering interfaces in production fleets. Confirm any feature-disable options with the vendor advisory.

If you can't patch immediately

Reduce exposure until the official fix is deployed everywhere.

• Segmentation: Place unpatched Pixels on restricted Wi‑Fi/VPN profiles with least privilege to corporate apps and data; avoid storing high-value secrets solely on those handsets.
• Access control: Require step-up authentication for sensitive actions; revoke local admin or high-risk app permissions where business allows.
• Virtual patching / edge controls: Mobile threat defense, app allowlisting, and network controls cannot fully substitute for a modem authorization fix, but can limit follow-on abuse paths; use only controls that do not break emergency calling or required carrier functions.
• Feature reduction: Disable nonessential radios, developer options, or enterprise features the vendor says touch the vulnerable path—only if confirmed safe in the advisory.
• Monitoring: Heighten logging for MDM compliance drift, unusual app privilege use, and radio/modem anomalies; retain evidence per your forensics requirements.
• Replacement path: If a device cannot receive the vendor mitigation, plan retirement or replacement per CISA’s discontinue-use guidance when mitigations are unavailable.

If your data may have been exposed

Actively exploited vulnerabilities can lead to device compromise and downstream data exposure even when ransomware use is not documented. If you suspect abuse of this issue, isolate affected devices, preserve logs, rotate credentials accessible from the handset, and complete forensic triage consistent with your policy and CISA guidance. As a simple personal check, you can run a free exposure scan of your email addresses against known breach datasets to see whether those identities already appear in public breach material, then proceed with organizational incident response as needed.