Google has released a security update for Pixel smartphones to address the CVE-2026-58704 vulnerability. The company confirmed that this flaw was already exploited in targeted cyberattacks against a limited group of users.
The vulnerability resided in the modem software and allowed attackers to escalate privileges. In certain scenarios, this could enable unauthorized access beyond the modem's isolated environment, potentially granting full control over the entire device.
The flaw supported zero-click attacks, meaning the compromise occurred automatically without requiring the user to click links, install apps, or interact with files. Google did not disclose the identities of the attackers or specific details regarding the exploitation methods.
While zero-click vulnerabilities are highly valued by developers of commercial spyware, Google stated that it does not link this specific incident to any particular actor or state-sponsored entity. The fix is now available in the latest security patch.
