Executive brief
A critical security vulnerability has been identified in the modem component of Google Pixel devices. This component manages cellular connectivity, and a flaw in how it handles incoming data could allow a remote attacker to execute unauthorized code on the device. This attack can be carried out over the mobile network without any user interaction or special permissions, potentially compromising the entire device's security and data privacy.
Technical details
A critical out-of-bounds write vulnerability exists in the Modem firmware of Google Pixel devices due to a missing bounds check during data processing. The flaw is reachable via the network stack, requiring no authentication or user interaction (Zero-click). Successful exploitation allows an attacker to achieve remote code execution (RCE) within the context of the modem processor. This vulnerability was addressed in the June 2026 Pixel Security Bulletin; users should update to the 2026-06-05 patch level or later.
Affected products
- Google Pixel Modem Devices prior to 2026-06-05 patch level
Timeline
- 2026-06-16: disclosed
- 2026-06-16: advisory
- 2026-06-05: patched