# CVE-2026-58704: Google Pixel improper authorization in cellular modem

Source: https://junglewise.ai/threats/cve-2026-58704-google-pixel-improper-authorization-in-cellular-modem  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-58704 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2026-09-15

Google Pixel smartphones contain an improper authorization vulnerability that allows attackers to gain unauthorized access to device functionality. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation in the wild, indicating attackers are actively using this flaw to compromise user devices. This vulnerability poses a significant risk to federal agencies and all organizations, as successful exploitation could grant an attacker complete control over the affected device.

Technologies: [Google Android](https://junglewise.ai/threats/technologies/android). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-58704 exploited in the wild?** Yes. CVE-2026-58704 is known to be exploited in the wild, first recorded on 16 September 2026. Treat it as urgent.

**How severe is CVE-2026-58704?** Critical severity, with a CVSS score of 8.8, published 15 September 2026.

**Which products and versions are affected?** Google Pixel <UNKNOWN>.

**Is there a fix for CVE-2026-58704?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-58704 attacked?** It is attacked over the network or with local access, in an operating system.

**Am I affected by CVE-2026-58704?** Check whether you run Google Android. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-58704 is an improper authorization vulnerability in Google Pixel devices that allows attackers to bypass authorization controls and gain unauthorized access to privileged functionality. The vulnerability has been added to CISA's KEV Catalog based on confirmed evidence of active exploitation by threat actors. As an improper authorization flaw, the vulnerability likely stems from insufficient access controls on sensitive device operations, potentially allowing an attacker to escalate privileges or access protected resources without proper authentication or authorization checks. Successful exploitation grants an attacker total control of the affected device post-compromise. Organizations and federal agencies are advised to prioritize patching this vulnerability on publicly exposed Pixel devices, with federal agencies required by BOD 26-04 to apply remediation rapidly. Google should issue security updates to address this authorization bypass.

## Affected products

- Google Pixel <UNKNOWN>

## Timeline

- 2026-09-16: kev added

## References

- [https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-one-known-exploited-vulnerability-catalog](https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-one-known-exploited-vulnerability-catalog)

## Related threats

- [Google Android Bluetooth buffer overflow in acquireMemory](https://junglewise.ai/threats/cve-2026-95405-in-acquirememory-of-bt-bqr-offload-cc-there-is-a-possible-way-to)
- [ST NFC HAL out-of-bounds write in global memory](https://junglewise.ai/threats/cve-2026-95400-in-stnfc-hal-write-of-hal-st21nfc-cc-there-is-a-possible-way-to)
- [Android HEVC decoder buffer overflow in sub_layer_hrd_parameters](https://junglewise.ai/threats/cve-2026-95397-in-sub-layer-hrd-parameters-of-hevc-decoder-there-is-a-possible)
- [Android framework memory exhaustion in message queue handling](https://junglewise.ai/threats/cve-2026-59632-in-respondreceivedmessage-of-mtsmessagecontroller-cpp-there-is-a)
- [Android use-after-free in UssiController connection listener](https://junglewise.ai/threats/cve-2026-59626-in-sendinfo-of-ussicontroller-cpp-there-is-a-possible-way-to)