Google patches Pixel modem flaw under active targeted exploitation
Google's September 2026 security update for Pixel devices resolves 110 vulnerabilities, including a high-severity zero-day in the cellular modem that has been exploited in limited targeted attacks. The flaw allows privilege escalation from an adjacent network without user interaction. Users are urged to install the update to the 2026-09-05 patch level.
The September 2026 Pixel update addresses 110 distinct vulnerabilities, with the modem flaw being the most urgent. Google's advisory describes the issue as a permission bypass stemming from a logic error in the cellular modem code. Attackers operating from a nearby network position could exploit it to gain elevated privileges without any user action, making it particularly dangerous for targeted operations.
Beyond the zero-day, the update covers 12 remote code execution flaws and 89 privilege escalation issues rated critical or high. This follows Google's June 2026 patch for another actively exploited Android Framework zero-day, and a May 2026 restructuring of its vulnerability rewards program that adjusted payouts based on AI-assisted discovery while increasing bounties for certain Android exploits.
The targeted exploitation of a modem-level flaw suggests sophisticated actors may be pursuing specific individuals or organizations, potentially including journalists, dissidents, or corporate targets. Because the attack requires only adjacent network access and no user interaction, it could be deployed in public settings like airports or offices. Most Pixel users face minimal risk, but the incident underscores how mobile devices remain attractive entry points for espionage. Broader adoption of prompt security updates may reduce exposure, though the gap between patch release and user installation remains a persistent vulnerability window.