Google says Pixel bug was exploited in targeted zero-day attacks

Google says a software bug in its Pixel smartphones was exploited in limited, targeted cyberattacks. The company has patched the vulnerability, which is tracked as CVE-2026-58704.

According to the limited details available, the flaw was found in the modem used by Pixel phones to connect to the internet. Exploiting it could let an attacker move beyond the modem’s sandbox and access broader phone data, a privilege-escalation scenario.

The bug could also be exploited silently, without any action from the phone owner. That makes it a “zero-click” vulnerability: a victim would not need to click a link or open a file.

Google did not identify who was exploiting the flaw. A Google spokesperson also did not respond to TechCrunch’s request for comment. TechCrunch noted that vulnerabilities of this kind are sometimes abused by surveillance vendors, including spyware makers that sell access to data-stealing software to governments and law-enforcement agencies. That possibility was not confirmed in this case.