CVE-2026-58704 Google Pixel: Google Pixel Improper Authorization Vulnerability

1. Executive summary

CVE-2026-58704 is an improper authorization flaw in the cellular modem of Google Pixel devices, where a logic error may allow an attacker to bypass permission checks and escalate privileges. The verified reference data records this as CVSS 8.0 HIGH, CWE-285 (Improper Authorization) with CWE-693, not listed in CISA KEV, with an EPSS score of 0%. No exploitation in the wild, no public proof-of-concept and no ransomware association are recorded. For EMEA financial services the exposure is limited to staff-issued or BYOD Pixel handsets that hold corporate credentials, MDM enrolment or authenticator apps — the risk is device-level privilege escalation, not a server-side or network-perimeter compromise. Note a discrepancy: the source text carries a remediation due date of 2026-09-19 under CISA BOD 26-04, while the verified data records the CVE as not in CISA KEV — the date is a US federal directive artefact, not a KEV due date, and is not binding on EMEA firms.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

The only candidate triggers — "a vulnerability exists", "patching is required", "a third-party vendor (Google) is involved" — are true of virtually every vulnerability advisory and do not change what a client must do under any named article. DORA Art. 28–30 third-party provisions are not engaged: a Pixel handset is an end-user device, not an ICT service supplied to the firm under a DORA-scoped contractual arrangement, and the source provides no evidence of a service-provider relationship. If a Pixel device is later confirmed compromised and the incident meets the firm's own materiality threshold, DORA Art. 17–19 and NIS2 Art. 23 reporting duties would be assessed at that point on the incident facts, not on this CVE.

3. Technical analysis & attack chain

The source material is thin — a single NVD record with no vendor bulletin, no CVSS vector string, no patch version and no PoC. The following chain reflects only what is confirmed.

1. Target: a Google Pixel device. The vulnerable component is the cellular modem.
2. Mechanism: a logic error in the modem's authorization handling — classified in the verified data as CWE-285 (Improper Authorization), with CWE-693 (Protection Mechanism Failure) as a secondary classification.
3. Effect: the logic error may allow an attacker to bypass permission checks.
4. Impact: privilege escalation on the affected device.

What the source does not establish (do not assume): it does not state whether exploitation is local (a malicious app or physical/USB access) or remote (over-the-air via a crafted cellular/baseband message), does not name an affected Pixel model or Android build, does not give a CVSS vector, and does not describe persistence, command-and-control, lateral movement or data exfiltration. The "cellular modem" locus is the detail that matters most for defenders: baseband-adjacent flaws are historically reachable without user interaction, but this source does not confirm that, and no such claim should be made to clients.

Exploitation status: the verified data records the CVE as not in CISA KEV with EPSS 0%. There is no evidence of in-the-wild exploitation, no public exploit code and no ransomware campaign use ("Known ransomware campaign use: Unknown" in the source). This is a patch-on-cycle item, not an emergency.

Confidence caveat: every technical claim above rests on a single source (the NVD record). No vendor advisory, no independent research and no telemetry corroborate it. Treat the mechanism description as single-sourced; verify against Google's Pixel security bulletin before making device-management decisions.

4. Mitigation & containment

The source directs only "apply mitigations in accordance with vendor instructions" and gives no patch version, build number or bulletin identifier. Do not invent one — obtain the applicable Pixel security bulletin from Google directly.

P1 — within 24h

• Inventory Pixel handsets in the estate (MDM query on manufacturer/model and Android security patch level). Establish how many are corporate-issued vs BYOD with corporate data access.
• Confirm the current Android security patch level on each device and identify any device that has not received a vendor update covering this CVE.
• Do not treat this as an emergency out-of-band action: not in KEV, EPSS 0%, no known exploitation. Prioritise by device role — handsets holding privileged credentials, MDM admin consoles or authenticator apps first.

P2 — within 72h

• Apply the vendor-supplied Pixel update to the prioritised cohort as soon as Google publishes it. Where no fix is yet available, apply the vendor's stated mitigations and restrict the device's access to high-value corporate resources (conditional-access policy: block or limit devices below the required patch level).
• Enforce MDM compliance policy requiring a minimum Android security patch level, so unpatched Pixel devices fall out of compliance automatically rather than relying on manual tracking.

P3 — within 7 days

• Roll the update to the remaining Pixel population and confirm compliance via MDM reporting.
• If the firm chooses to track the source's 2026-09-19 date as an internal prioritisation target, note it derives from CISA BOD 26-04 (a US federal directive) and is not a CISA KEV remediation due date — the verified data records this CVE as not in KEV.

5. Indicators of compromise

No indicators of compromise available in the source material.

The source describes no observable authentication patterns, device registrations, process activity or network behaviour, so no behavioural-indicator table is provided either.

6. Detection

Insufficient indicators to author detection rules.

The source contains no distinctive strings, command-line flags, file paths, registry keys, mutexes, scheduled-task names or hard-coded values. Emitting a rule keyed on the CVE identifier or the product name would detect reporting about the vulnerability, not the threat, and is not warranted.

CVE assessment

1 referenced CVE

7. Sources

• NVD — CVE-2026-58704 Detail — https://nvd.nist.gov/vuln/detail/CVE-2026-58704 — published 2026-09-15

8. Adverse Trace position

We assess CVE-2026-58704 as a moderate-priority, patch-on-cycle item for EMEA financial services: CVSS 8.0 HIGH on paper, but not in CISA KEV, EPSS 0%, no known exploitation, no public PoC and no ransomware association. The practical client impact is confined to Pixel handsets that carry corporate access, and the realistic worst case is local privilege escalation on an individual device rather than a network- or estate-level compromise. The material weakness in this advisory is source quality, not severity: the entire technical picture is single-sourced from NVD, with no vendor bulletin, no affected-version list and no patch identifier — clients should verify against Google's Pixel security bulletin before acting, and we will not present the mechanism as corroborated until a second source confirms it. Adverse Trace will monitor for a Google Pixel security bulletin naming this CVE, for any change in KEV or EPSS status, and for the first credible report of in-the-wild exploitation, and will re-issue if any of those materialise.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.