Google patches Pixel zero-day exploited in targeted attacks

Google says a bug in its Pixel smartphones’ software was exploited in limited, targeted cyberattacks. The company said Tuesday that the flaw, tracked as CVE-2026-58704, has now been patched.

According to the limited details Google has released, the bug was found in the Pixel’s modem — the component that lets the device connect to the internet. Exploiting it could let an attacker break out of the modem’s sandboxed environment and reach the broader phone’s data, a type of flaw known as privilege escalation.

The bug can be exploited silently, with no interaction from the phone’s owner, in what’s known as a “zero-click” attack — meaning a victim doesn’t need to click a link or open a file for the attack to work.

Google hasn’t said who was exploiting the bug, and a company spokesperson didn’t respond to a request for comment. Bugs like this one aren’t uncommon targets for surveillance vendors, including spyware makers that sell access to data-stealing software to governments and law-enforcement agencies.

Why it matters

Zero-click, zero-day bugs in phone modems are prized by surveillance vendors precisely because they leave no trace of user interaction, and Google’s disclosure is a reminder that even patched, mainstream devices remain a target for that market.