{"id":26125,"date":"2026-10-02T16:48:53","date_gmt":"2026-10-02T12:48:53","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/?p=26125"},"modified":"2026-10-02T16:48:53","modified_gmt":"2026-10-02T12:48:53","slug":"google-pixel-september-2026-security-update","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/google-pixel-september-2026-security-update\/26125\/","title":{"rendered":"Google patches 110 vulnerabilities in Pixel smartphones"},"content":{"rendered":"

On September 15 this year, Google published details of patches for 110 vulnerabilities in its own Google Pixel smartphones. Among all the disclosed flaws, CVE-2026-58704<\/a> stands out the most, for it appears that this zero-day is being exploited in targeted attacks.<\/p>\n

In today\u2019s post, we talk about what\u2019s so special about the Google Pixel, and why these devices get security updates all of their own \u2013 separate from regular Android updates. We also cover the vulnerabilities addressed in this latest update, with a special focus on the mentioned, most dangerous one \u2013 CVE-2026-58704 \u2013 and wrap up with tips on how to both protect your device and avoid becoming a victim of cyberattack on it.<\/p>\n

Why do Google Pixel phones get security updates separate from Android?<\/h2>\n

The reader might reasonably wonder: I\u2019ve already installed this month\u2019s Android security updates on my Google Pixel. Isn\u2019t that the same thing? Google Pixel does run on Android and receives those security updates, which are detailed in the monthly Android Security Bulletin<\/a>. However, manufacturers of Android-based devices use different sets of hardware and software components. That\u2019s why, alongside vulnerabilities common to all Android devices, there are security issues specific to individual manufacturers\u2019 devices.<\/p>\n

For its own smartphones, Google publishes separate security updates, covered by a dedicated Pixel Update Bulletin<\/a>. Rather than replacing the Android Security Bulletin, this document complements it by detailing vulnerabilities specific to devices manufactured by Google. Other Android smartphones also receive similar updates from their manufacturers.<\/p>\n

The Pixel Update Bulletin for September 2026<\/a> clearly shows why Google needs separate updates for its smartphones in the first place. Many of the vulnerabilities it fixes affect specific Pixel hardware (or hardware-related) components: the modem, bootloader, GPU, fingerprint scanner components, and other parts of the device. On smartphones from other manufacturers, these features might rely on entirely different hardware and software components, so the fixes listed in the Pixel Update Bulletin don\u2019t apply to those phones.<\/p>\n

That said, these vulnerabilities could still be relevant for Pixel owners who\u2019ve flashed their devices with custom ROMs. Switching to a different OS doesn\u2019t alter the device\u2019s hardware components, and may not replace the firmware. Therefore, the vulnerabilities themselves may persist, but whether patches are available, and how they\u2019re installed, depends on the specific OS.<\/p>\n

CVE-2026-58704: a zero-day vulnerability being actively exploited in the wild<\/h2>\n

Now let\u2019s look closer at the specific vulnerabilities Google fixed in September. The most significant one is the above-mentioned CVE-2026-58704<\/a>.<\/p>\n

This vulnerability affects the Cellular Modem component, which handles the smartphone\u2019s communication with cellular networks. It stems from a logic error in the code, which, under certain conditions, allows bypassing the intended permission check.<\/p>\n

Successful exploitation of CVE-2026-58704 lets attackers escalate privileges on the smartphone to gain broader access to its functions and data. Note that the attack takes place over a cellular network and the threat actors need low-level privileges on the targeted device to start with.<\/p>\n

In practice, this means attackers can\u2019t exploit CVE-2026-58704 to attack a Pixel from just anywhere over the internet, as they\u2019d apparently need to either compromise the cellular network the target smartphone is already connected to or, more likely, force it to connect to a malicious base station under their control.<\/p>\n

Google hasn\u2019t disclosed all the details of this vulnerability yet, and the related report is not publicly accessible. As a result, the technical details that would show how easy it is for attackers to exploit CVE-2026-58704 remain unknown pending installation of the patches on all devices.<\/p>\n

Nevertheless, Google claims that there are signs of limited exploitation of CVE-2026-58704.<\/p>\n

What we know about the other 109 vulnerabilities<\/h2>\n

Of the remaining 109 vulnerabilities found in Google Pixel devices, only one is rated moderate; the others are either high (62) or outright critical (46). Nine of these flaws fall into the RCE (remote code execution) category. This means that if an attacker successfully exploits one of these vulnerabilities, they can remotely force the device to run malicious code. The exact conditions for the attack depend on the specific vulnerability.<\/p>\n

Another 88 vulnerabilities fall into the elevation of privilege (EoP) category. These let an attacker who\u2019s already gained a certain level of access to the device expand their privileges. The CVE-2026-58704 vulnerability discussed above falls into this same category, which is why the September bulletin lists 89 EoP vulnerabilities in total.<\/p>\n

Finally, 10 vulnerabilities can lead to information disclosure (ID), and two more to denial of service (DoS). In short, that\u2019s a hefty list of flaws, so Google Pixel owners shouldn\u2019t wait around to install the patches.<\/p>\n

How to avoid becoming a victim<\/h2>\n

Google Pixel owners can install the update that fixes the vulnerabilities covered in this post by following this path: Settings<\/em> \u2192 Security & privacy<\/em> \u2192 System & updates<\/em> \u2192 Security update<\/em> \u2192 Install<\/em>. Keep in mind that the phone will automatically restart to finish installing the update.<\/p>\n

To keep your phone secure we recommend the following general measures:<\/p>\n