Executive brief
Google Pixel devices contain a modem—the radio component that handles cellular communications—with an information disclosure vulnerability. An attacker on a nearby network can remotely read sensitive data from the device without any special privileges or user interaction, potentially exposing call records, messages, or device identifiers. This patch is included in the September 2026 security update for all supported Pixel devices.
Technical details
The vulnerability is an information disclosure flaw in the Modem component caused by improper input validation, allowing remote attackers to access sensitive information without requiring execution privileges or user interaction. The attack vector is network-based, and exploitation may involve specially crafted modem protocol messages that bypass input validation checks. The Pixel September 2026 security patch (2026-09-05 patch level or later) addresses this issue; affected versions are those earlier than the 2026-09-05 security patch level on supported Pixel devices.
Affected products
- Google Pixel (all supported models) Earlier than 2026-09-05 security patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched