Critical Android 0-Day CVE-2023-42118 Actively Exploited on Google Pixel Phones

Key Takeaways

• Google has confirmed active exploitation of a high-severity zero-day vulnerability, CVE-2026-58704, affecting its Pixel smartphones.
• The flaw, an elevation-of-privilege issue in the device’s cellular modem, allows for remote (proximal/adjacent) access with low complexity and no user interaction.
• Exploitation is described as “limited, targeted,” suggesting sophisticated actors or commercial spyware vendors are involved.
• Google has released emergency patches as part of the September 2026 Pixel Update Bulletin.
• Users are strongly advised to update their Pixel devices to the 2026-09-05 security patch level or later immediately.

Critical Android Pixel 0-Day Actively Exploited

Google has issued an urgent warning regarding a critical zero-day vulnerability, identified as CVE-2026-58704, that is currently being exploited in the wild. This high-severity flaw specifically impacts Google Pixel smartphones, prompting the immediate release of emergency patches within the September 2026 Pixel Update Bulletin.

Understanding CVE-2026-58704

The vulnerability, tracked as CVE-2026-58704, resides within the device’s cellular modem subcomponent. It is classified as an elevation-of-privilege (EoP) weakness stemming from a logic error that bypasses permission controls. Google’s advisory details that this flaw “could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed.”

In practical terms, an attacker in close proximity to a target device, operating on an adjacent network, could elevate their privileges without needing prior extensive access. The attack is notably sophisticated, requiring low complexity and no user interaction, meaning a victim does not need to click a link, install an application, or otherwise engage for the exploit to succeed. This “zero-click” nature makes modem-level vulnerabilities particularly dangerous, as they can serve as a covert entry point for more profound device compromise.

Google’s description of the exploitation as “limited, targeted” is consistent with past instances involving commercial spyware vendors and state-sponsored surveillance operations. This phrasing suggests a focus on specific, high-value individuals rather than widespread, indiscriminate attacks.

Comprehensive September Pixel Update

CVE-2026-58704 is one of many vulnerabilities addressed in the September 2026 Pixel bulletin, which was published on September 15. The official advisory, released by Google, details a total of 110 vulnerabilities patched across Pixel hardware. This includes 12 remote code execution (RCE) flaws and 89 privilege escalation issues, many rated as critical or high severity.

Significant RCE vulnerabilities were found in components such as the IP Multimedia Subsystem, libpixelimsmedia, the VPU, the Modem, and the BigOcean media engine. Additionally, critical EoP fixes were applied to numerous components related to the bootloader, Trusted Execution Environment, and Titan security. Pixel devices, due to their Google-controlled hardware, receive a dedicated security bulletin separate from the broader Android Security Bulletin distributed to other OEMs.

This Pixel-specific update builds upon the wider September 2026 Android security update, which reportedly addressed approximately 180 vulnerabilities across the Android ecosystem, including critical flaws like the Wi-Fi memory-corruption bug CVE-2026-28662. Google released two patch strings this month: 2026-09-01 and 2026-09-05. The latter level incorporates all applicable September fixes, along with any prior outstanding issues.

Affected Devices and End-of-Life Information

All supported Google Pixel devices are receiving this crucial update. The supported lineup includes models from the Pixel 6 series through the newly introduced Pixel 11 family, as well as the Pixel Tablet and Fold devices. Users with a security patch level of 2026-09-05 or later will be fully protected against CVE-2026-58704 and all other issues detailed in the bulletin.

Owners of the Pixel 6 and 6 Pro should note that these handsets are approaching their end-of-life in October 2026, making this one of their final guaranteed security updates.

What You Should Do

• Update Immediately: Pixel users should navigate to Settings > Security & privacy > System & updates > Security update, then tap Install and restart their device.
• Verify Patch Level: Ensure your device is updated to the 2026-09-05 security patch level or later.
• Consider Manual Flashing: Advanced users can download firmware images from the Google Developer site for manual installation.
• Prioritize for High-Risk Individuals: Given confirmed active exploitation, this patch is critically urgent, especially for individuals who might be targets of sophisticated surveillance, such as journalists, executives, and activists.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.