Google confirms Pixel flaw was exploited in targeted zero-click attacks

Google says a software flaw affecting Pixel smartphones was exploited in a limited number of targeted cyberattacks. The company said Tuesday that the vulnerability, tracked as CVE-2026-58704, has been patched.

Available details indicate that the flaw was located in Pixel phones’ modem software, which handles cellular network connections. An attacker could potentially exploit it to escape the modem’s security sandbox and access broader data on the device, a form of privilege escalation.

The vulnerability could be exploited without any action from the phone’s owner, making it a “zero-click” attack. Victims would not need to click a link or open a file for the exploit to succeed.

Google did not identify who was behind the attacks, and a company spokesperson did not immediately respond to a request for comment. Vulnerabilities of this kind have previously been used by surveillance vendors, including spyware developers that provide governments and law enforcement agencies with tools capable of stealing data.

Source link