Reading view
Gerucht: nieuwe, goedkope iPhone 18e krijgt 60Hz-scherm, net als de iPad mini
Redmi K100-smartphone heeft 10.000 mAh-accu en Snapdragon 8 Elite-soc
Gerucht: OPPO Find X10 Ultra krijgt 100MP-selfiecamera met vierkante sensor
JerryRigEverything: iPhone Duo kan ondanks IP68-rating niet tegen stof en zand
Apple brengt iOS 27.2 uit met Apple Pencil-ondersteuning voor iPhone Duo
Apple erkent probleem met scherm iPhone Duo en vervangt getroffen exemplaren
OPPO Find X10 Pro Max krijgt '600-megapixelcamerasysteem' voor 1800 euro
Google bouwt functie om AI naar vrienden en familie te laten bellen
Trump Mobile lijkt gehackt, maar 'heeft geen team om ermee om te gaan'
Google maakt Pixel 10a stilletjes 100 euro duurder
110 vulnerabilities fixed in Google Pixel devices | Kaspersky official blog
On September 15 this year, Google published details of patches for 110 vulnerabilities in its own Google Pixel smartphones. Among all the disclosed flaws, CVE-2026-58704 stands out the most, for it appears that this zero-day is being exploited in targeted attacks.
In todayβs post, we talk about whatβs so special about the Google Pixel, and why these devices get security updates all of their own β separate from regular Android updates. We also cover the vulnerabilities addressed in this latest update, with a special focus on the mentioned, most dangerous one β CVE-2026-58704 β and wrap up with tips on how to both protect your device and avoid becoming a victim of cyberattack on it.
Why do Google Pixel phones get security updates separate from Android?
The reader might reasonably wonder: Iβve already installed this monthβs Android security updates on my Google Pixel. Isnβt that the same thing? Google Pixel does run on Android and receives those security updates, which are detailed in the monthly Android Security Bulletin. However, manufacturers of Android-based devices use different sets of hardware and software components. Thatβs why, alongside vulnerabilities common to all Android devices, there are security issues specific to individual manufacturersβ devices.
For its own smartphones, Google publishes separate security updates, covered by a dedicated Pixel Update Bulletin. Rather than replacing the Android Security Bulletin, this document complements it by detailing vulnerabilities specific to devices manufactured by Google. Other Android smartphones also receive similar updates from their manufacturers.
The Pixel Update Bulletin for September 2026 clearly shows why Google needs separate updates for its smartphones in the first place. Many of the vulnerabilities it fixes affect specific Pixel hardware (or hardware-related) components: the modem, bootloader, GPU, fingerprint scanner components, and other parts of the device. On smartphones from other manufacturers, these features might rely on entirely different hardware and software components, so the fixes listed in the Pixel Update Bulletin donβt apply to those phones.
That said, these vulnerabilities could still be relevant for Pixel owners whoβve flashed their devices with custom ROMs. Switching to a different OS doesnβt alter the deviceβs hardware components, and may not replace the firmware. Therefore, the vulnerabilities themselves may persist, but whether patches are available, and how theyβre installed, depends on the specific OS.
CVE-2026-58704: a zero-day vulnerability being actively exploited in the wild
Now letβs look closer at the specific vulnerabilities Google fixed in September. The most significant one is the above-mentioned CVE-2026-58704.
This vulnerability affects the Cellular Modem component, which handles the smartphoneβs communication with cellular networks. It stems from a logic error in the code, which, under certain conditions, allows bypassing the intended permission check.
Successful exploitation of CVE-2026-58704 lets attackers escalate privileges on the smartphone to gain broader access to its functions and data. Note that the attack takes place over a cellular network and the threat actors need low-level privileges on the targeted device to start with.
In practice, this means attackers canβt exploit CVE-2026-58704 to attack a Pixel from just anywhere over the internet, as theyβd apparently need to either compromise the cellular network the target smartphone is already connected to or, more likely, force it to connect to a malicious base station under their control.
Google hasnβt disclosed all the details of this vulnerability yet, and the related report is not publicly accessible. As a result, the technical details that would show how easy it is for attackers to exploit CVE-2026-58704 remain unknown pending installation of the patches on all devices.
Nevertheless, Google claims that there are signs of limited exploitation of CVE-2026-58704.
What we know about the other 109 vulnerabilities
Of the remaining 109 vulnerabilities found in Google Pixel devices, only one is rated moderate; the others are either high (62) or outright critical (46). Nine of these flaws fall into the RCE (remote code execution) category. This means that if an attacker successfully exploits one of these vulnerabilities, they can remotely force the device to run malicious code. The exact conditions for the attack depend on the specific vulnerability.
Another 88 vulnerabilities fall into the elevation of privilege (EoP) category. These let an attacker whoβs already gained a certain level of access to the device expand their privileges. The CVE-2026-58704 vulnerability discussed above falls into this same category, which is why the September bulletin lists 89 EoP vulnerabilities in total.
Finally, 10 vulnerabilities can lead to information disclosure (ID), and two more to denial of service (DoS). In short, thatβs a hefty list of flaws, so Google Pixel owners shouldnβt wait around to install the patches.
How to avoid becoming a victim
Google Pixel owners can install the update that fixes the vulnerabilities covered in this post by following this path: Settings β Security & privacy β System & updates β Security update β Install. Keep in mind that the phone will automatically restart to finish installing the update.
To keep your phone secure we recommend the following general measures:
- Install security updates on your phone regularly and promptly β whether itβs a Google Pixel, an Android smartphone from a different manufacturer, or even an iPhone.
- Avoid installing apps from questionable sources.
- Read reviews before installing apps from official stores, since malware isnβt uncommon there too. Users who have already been burned will often sound the alarm in the reviews long before store moderators get around to removing the dangerous app.
- InstallΒ a reliable security solutionΒ to keep you from downloading malware, and warn you about suspicious activity on your device.



