Google Pixel September 2026 Update Patches Modem Privilege Escalation Under Targeted Exploitation and 46 Critical Flaws (CVE-2026-58704)

Scope: Google Pixel Devices (All Models Running Security Patch Level Earlier Than 2026-09-05)

Severity: High

Google released its September 2026 Pixel update today addressing 110 security vulnerabilities, with CVE-2026-58704, a privilege escalation flaw in the Pixel modem component, confirmed by Google as being under limited targeted exploitation in the wild. The update also addresses 46 critical-severity vulnerabilities across Pixel components including BigOcean, Bootloader, IP Multimedia Subsystem, and Trusted Execution Environment, covering privilege escalation and remote code execution attack paths. Modem-level privilege escalation is particularly serious because it can bypass application-layer and OS-layer security controls, operating below the Android security model's standard trust boundaries. All Pixel device users must update to the September 2026 security patch level (2026-09-05 or later) immediately via Settings, Security and Privacy, System Update, and verify the patch level displays correctly after the update completes.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.