CVE-2026-58704 · Low · CISA KEV

Google Pixel Modem Vulnerability: Privilege Escalation via Improper Authorization

Threat Engine Auto-Feed · data current as of 2026-09-16

A critical improper authorization vulnerability in Google Pixel cellular modems allows attackers to bypass permission checks and escalate privileges. This flaw is actively exploited in the wild, posing a significant risk to affected devices. While the EPSS is low, its presence in the CISA KEV list highlights its real-world impact.

  • CVSS:
  • EPSS percentile: 0.01564
  • Exploitation pressure: 26/100 (Low)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 2th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

Improper authorization means that a system or application fails to correctly verify if a user or process has the necessary permissions to perform a specific action. This can lead to unauthorized access to resources or the ability to perform actions that should be restricted, potentially escalating privileges.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations utilizing Google Pixel devices for sensitive operations or storing critical data on them
  • Enterprises where mobile devices are used to access internal networks or privileged systems
  • Financial services and Technology sectors, due to documented targeting by relevant threat actors

Misconfigurations that escalate it

  • Lack of robust mobile device management (MDM) policies to enforce security updates
  • Insufficient monitoring for unusual activity originating from mobile devices
  • Over-reliance on device-level security without layered controls

High-impact scenarios

  • An attacker gaining elevated privileges on a compromised Pixel device, leading to data exfiltration or further network penetration
  • Unauthorized access to sensitive information stored on the device or accessible through the device's network connections
  • Potential for lateral movement within an enterprise network if the compromised device has access to internal resources

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor for unusual process activity or privilege changes on Google Pixel devices
  • Implement robust mobile device management (MDM) solutions to track device health and compliance
  • Analyze network traffic from Pixel devices for anomalous connections or data transfers

Contain

  • Isolate affected Google Pixel devices from critical networks upon detection of compromise
  • Revoke access tokens or credentials associated with potentially compromised devices
  • Perform forensic analysis on any suspected compromised Pixel devices to understand the extent of impact

Patch

  • Apply all available security updates and patches from Google for Pixel devices immediately
  • Ensure all managed Pixel devices are configured for automatic updates or are updated promptly

Frontier verdict — Low

This vulnerability requires immediate attention due to active exploitation in the wild and its potential for privilege escalation on Google Pixel devices.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.