**Google** has released its latest security update for **Pixel** devices, tackling 110 vulnerabilities. This extensive patch includes a high-severity zero-day, **CVE-2026-58704**, which the company states is already being exploited in targeted attacks. "There are indications that **CVE-2026-58704** may be under limited, targeted exploitation," **Google** warned in its official bulletin. "All supported **Google** devices will receive an update to the 2026-09-05 patch level. We encourage all customers to accept these updates to their devices." ## The Zero-Day Threat: CVE-2026-58704 This critical flaw resides in the **Modem** subcomponent and is attributed to improper authorization and protection mechanism failures. Successful exploitation of **CVE-2026-58704** could allow attackers with access to an adjacent network and basic privileges on the target device to escalate privileges. The attack complexity is low and requires no user interaction. **Google**'s advisory elaborates: "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed." ## Beyond the Zero-Day: A Broad Patch Beyond the zero-day, this month's **Pixel** update bulletin addresses 109 other security issues. These include 12 remote code execution (RCE) vulnerabilities and 89 privilege escalation flaws, many of which are rated critical or high severity. ## Pixel's Unique Update Cycle While **Google Pixel** devices run **Android**, they receive a separate set of security updates and bug fixes. This is due to the unique hardware platform and exclusive features directly controlled by **Google**, distinguishing their update schedule from the standard monthly patches distributed to other **Android** OEMs. ## How to Update Your Pixel Device **Pixel** users are strongly encouraged to apply these crucial security updates immediately. To do so, navigate to `Settings > Security & privacy > System & updates > Security update`, tap `Install`, and then restart your device to complete the process. Further details on the September 2026 updates for **Pixel** devices can be found in the official [security bulletin](https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01). ## Previous Exploited Flaws and Bounty Program Shifts This isn't the first time **Google** has had to address actively exploited zero-days. In June, the company patched an **Android Framework** zero-day, **CVE-2025-48595**, which could have allowed attackers to gain code execution and escalate privileges on devices running **Android 14** or later. Earlier this year, **Google** also announced significant changes to its **Android** and **Chrome** vulnerability rewards programs. While scaling back payouts for flaws easily discoverable with AI, the company is now offering bounties of up to $1.5 million for certain high-impact **Android** exploits, signaling a strategic shift in incentivizing critical security research.