Reported by 26 outlets
Google fixes actively exploited Android zero-day on Pixel devices
Why this score
- Breadth
- 2.00 / 2.0 · 26 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.40 / 1.5 · reddit signal
- Score
- 0.4 / 10 = base × recency + community
Desk analysis
Google's September 2026 Pixel Update Bulletin patches 110 vulnerabilities, and CVE-2026-58704 is the one that carries real weight: a permission bypass in the cellular modem, rated high at CVSS 3.1 8.0, caused by a logic error that defeats an authorization check. Google reports indications of limited, targeted exploitation, and the CVE record states plainly that it enables remote proximal or adjacent escalation of privilege with no additional execution privileges and no user interaction. CISA added it to the Known Exploited Vulnerabilities catalog on September 16 with a September 19 remediation deadline for federal agencies. The same two weeks produced two more exploited Google bugs already in the timeline: CVE-2026-85046, a V8 type confusion reported by Salvatore Gulizia on August 4 under Chromium issue 542403045 and fixed September 3 in Chrome 152.0.7977.82/.83, and CVE-2026-87491, a V8 out-of-bounds write fixed September 8 in 153.0.8010.36/.37 as the seventh exploited Chrome bug of the year.
The Pixel modem bug is the operationally serious item, and not because of its score. A browser zero-day still needs the victim to reach attacker-controlled content; a zero-click modem flaw does not, and it runs beneath the app layer where endpoint telemetry, phishing training, and user vigilance all see nothing. That profile matches commercial spyware tradecraft, and Google's refusal to name an actor, a victim count, or a delivery method while saying "limited, targeted" fits that reading better than commodity criminal activity. The Chrome pair is the volume story: exploitation of CVE-2026-85046 was confirmed in the wild, and its KEV listing on September 8 came five days after the fix shipped, which means real-world exploitation outlasted patch availability rather than ending at disclosure. The uncomfortable conclusion the event list does not spell out is that for CVE-2026-58704 there is no detection layer to hunt in; the patch level of the fleet is the entire control surface.
Actions follow from that inversion. On Pixel, install the update from Settings, then Security and privacy, then System and updates, then Security update, and restart; a device is current only when the Android security update level reads 2026-09-05 or later, and Google says all supported Pixels receive it. Enforce that patch string in MDM inventory and treat every managed Pixel below 2026-09-05 as exposed to adjacent attackers, not as waiting on a normal cycle. For Chrome, the minimum builds are 152.0.7977.82/.83 on Windows and macOS and 152.0.7977.82 on Linux for CVE-2026-85046, then 153.0.8010.36/.37 for CVE-2026-87491; stable has since moved to 154.0.8037.57/.58 as of September 22, so verify exact versions through chrome://version or browser management version reports rather than trusting the update banner, and force relaunches so pending installs actually apply. Where KEV applies, track the September 19 deadline explicitly instead of folding this into next month's patch window.
Two developments would change this assessment. Attribution or technical detail on the CVE-2026-58704 campaign, an identified spyware vendor, a named delivery vector, or any victim count would convert a targeted-modem problem into a fleet-wide exposure question for anyone with unpatched Pixels near hostile networks. The second is cadence: Chrome shipped 230 fixes on September 8, 42 more on September 15, and 108 in 154 on September 22 under a two-week release cycle, and a pattern of six exploited V8 bugs by early September followed by a seventh on September 8 makes an eighth a question of when, not whether, which shortens the safe window for any browser fleet that lags stable.
Timeline
-
original reporting
Google fixes actively exploited Android zero-day on Pixel devices
bleepingcomputer.com · 27d ago · September 16th, 2026
Google has released the September 2026 security patches to address 110 vulnerabilities affecting its Pixel devices, including one zero-day flaw actively exploited in targeted attacks. "There are indications that CVE-2026-58704 may be under limited, targeted exploitation," the company warned on Wednesday. "All supported Google devices will receive an update to the 2026-09-05 patch level. We encourage all customers to accept these updates to their devices." This high-severity security flaw stems from improper authorization and protection mechanism failure weaknesses affecting the Modem subcomponent. Successful exploitation can allow attackers with access to an adjacent network and basic privileges on the targeted device to escalate privileges in low-complexity attacks that don't require user interaction. "In Cellular Modem, there is a possible permission bypass due to a logic error in the code," a security advisory issued today says. "This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed." Google tagged 109 other security issues in this month's Pixel update bulletin, including 12 remote code execution and 89 privilege escalation vulnerabilities rated critical or high severity. Although Google Pixel devices also run Android, they receive separate security updates and bug fixes from the standard monthly patches distributed to Android OEMs because of the unique hardware platform Google controls directly and its exclusi
-
update from googleblog.com
Stable Channel Update for Desktop (Chrome 152.0.7977.82/.83)
googleblog.com · 40d ago · September 3rd, 2026
Google's Chrome team announced the stable channel update to 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, carrying 12 security fixes. High-severity CVE-2026-85046, a type confusion in V8, was reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-04 and carried a $1,000 reward. Google stated it was aware that an exploit for CVE-2026-85046 exists in the wild, making this the vendor advisory that predated the story's first captured coverage.
-
update from cve.org
CVE-2026-85046 record published by the Chrome CNA
cve.org · 40d ago · September 3rd, 2026
The CVE Program record for CVE-2026-85046 was published on 2026-09-03 by the Chrome CNA, describing type confusion in V8 in Google Chrome prior to 152.0.7977.82 that allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The record cites the Chrome Releases advisory and Chromium issue 542403045 as references.
-
update from cyberpress.org
Google Chrome V8 Flaw Exploited in the Wild to Execute Arbitrary Code
cyberpress.org · 39d ago · September 4th, 2026
Successful exploitation may let a malicious website corrupt memory and potentially execute arbitrary code within Chrome’s process. Chrome 152.0.7977.82/.83 is rolling out to Windows and macOS users, while Linux users receive version 152.0.7977.82. Google Chrome V8 Flaw Exploited Organizations should not wait for normal patch cycles: they should verify that managed endpoints receive the fixed build promptly and relaunch the browser to complete installation. CVE-2026-85046 is a type-confusion flaw in V8, Chrome’s engine for processing JavaScript and WebAssembly. Type confusion occurs when software treats a memory object as if it were a different type than it is. In memory-safe conditions, those expectations are validated. For a browser-targeting operation, the initial interaction can be deceptively simple: a victim visits attacker-controlled web content, or content delivered through a compromised legitimate site. The browser’s sandbox and modern exploit mitigations can limit the impact of a renderer compromise, but sophisticated attackers may pair a V8 vulnerability with a sandbox escape or local privilege-escalation bug.
-
update from gbhackers.com
Google Chrome V8 Flaw Actively Exploited in the Wild, Update Released
gbhackers.com · 39d ago · September 4th, 2026
The security update […] The post Google Chrome V8 Flaw Actively Exploited in the Wild, Update Released appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from securityweek.com
Google Patches 6th Chrome Zero-Day of 2026
securityweek.com · 39d ago · September 4th, 2026
While the company has not shared details on the security defect, type confusion flaws in the V8 engine may be exploited to perform remote read/write operations via crafted HTML pages. The other five are CVE-2026-2441 , CVE-2026-3909, CVE-2026-3910 , CVE-2026-5281 , and CVE-2026-11645 . The updates address nine other high-severity bugs, including out-of-bounds read/write, incomplete cleanup, use-after-free, race condition, improper resource exposure, and type confusion issues. Three of them have been reported by external researchers. Additionally, Google fixed two medium-severity improper input validation and use-after-free weaknesses. Related: Chrome and Firefo
-
update from bleepingcomputer.com
Google warns of new Chrome zero-day flaw exploited in attacks
bleepingcomputer.com · 39d ago · September 4th, 2026
It was reported to Google by researcher Salvatore Gulizia, known online as “Serotav.” The update brings Chrome to version 152.0.7977.82/.83 on Windows and macOS, and 152.0.7977.82 on Linux, as part of a gradual rollout.. The company did not disclose any technical or specific exploitation details about the flaw to give users and dependent projects time to apply the fix. Type confusion flaws cause software to misinterpret one type of object as another, allowing attackers to corrupt memory. V8 is Chrome’s open-source JavaScript and WebAssembly engine, which compiles and executes code used by websites. Previous fixes i
-
update from socprime.com
CVE-2026-85046: Actively Exploited Chrome V8 Zero-Day Enables Code Execution
socprime.com · 39d ago · September 4th, 2026
Google has confirmed that an exploit exists in the wild but has not disclosed information about the threat actors, targeted organizations, or attack campaigns while the update is still rolling out. CVE-2026-85046 analysis The vulnerability is categorized as CWE-843: Access of Resource Using Incompatible Type, commonly referred to as type confusion. This class of memory-safety weakness occurs when software incorrectly treats an object as a different data type than the one actually stored in memory. In JavaScript engines such as V8, incorrect assumptions about object types can become particularly d
-
update from malware.news
Google security advisory (AV26-883)
malware.news · 39d ago · September 4th, 2026
Serial Number: AV26-883 Date: September 4, 2026 As of September 3, 2026, Google is affected by vulnerabilities in the following product: Chrome Prior to 152.0.7977.82 Google is aware that an exploit for CVE-2026-85046 exists in the wild. The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
-
mentioned by go.dhs.gov
🛡️ We added Google Chromium V8 type confusion vulnerability CVE-2026-85046 to our Known Exploited Vulnerabilities Catalog. Visit https:// go
go.dhs.gov · 35d ago · September 8th, 2026
-
update from 9to5google.com
Google Chrome starts two-week release cycle with version 153 As previewed earlier this year, Google Chrome is now operating on a two-week re
9to5google.com · 35d ago · September 9th, 2026
Google Chrome starts two-week release cycle with version 153 As previewed earlier this year, Google Chrome is now operating on a two-week re
via Mastodon https://9to5google.com/2026/09/08/chrome-updates-two-weeks/
-
mentioned by securityonline.info
Google patched a Chrome zero-day, CVE-2026-87491, exploited in the wild. Chrome 153 fixes 230 flaws including critical WebGL bugs. Update no
securityonline.info · 35d ago · September 9th, 2026
-
update from cyberpress.org
Google Chrome 153 Fixes 230 Security Flaws Including V8 Bug Exploited in the Wild
cyberpress.org · 34d ago · September 9th, 2026
Google Chrome 153 Fixes 230 Security Flaws Out-of-bounds write bugs occur when software writes data outside the intended memory boundary, potentially corrupting memory and enabling browser crashes, arbitrary code execution, or further exploitation when chained with another vulnerability. A malicious website could trigger a V8 defect simply by loading in the browser. The company is withholding certain bug details and issue links until most Chrome users receive the patched release, a standard measure intended to reduce the window for opportunistic exploitation. Four affect WebGL, including two use-after-free flaws, an out-of-bounds write, and a buffer overflow. WebGL and GPU-facing components are attr
-
update from gbhackers.com
Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild
gbhackers.com · 34d ago · September 9th, 2026
Because of the unusually large number of fixes, consumers and enterprise defenders should update their browsers promptly.
-
mentioned by bleepingcomputer.com
Google warns of new Chrome zero-day bug exploited in attacks
bleepingcomputer.com · 34d ago · September 9th, 2026
-
mentioned by diesec.com
Chrome's 6th zero-day of 2026: CVE-2026-85046 (CVSS 8.8). Google says an exploit existed in the wild when it shipped the Sep 3 fix. CISA KEV
diesec.com · 34d ago · September 9th, 2026
-
mentioned by cyberworldops.eu
Google fixed CVE-2026-87491, an out-of-bounds write in Chrome V8 exploited in the wild via crafted HTML. It enables arbitrary code execution
cyberworldops.eu · 34d ago · September 9th, 2026
-
mentioned by chromereleases.googleblog.com
Google Chrome # zeroday Google is aware that an exploit for CVE-2026-87491 exists in the wild. https:// chromereleases.googleblog.com/ 2026/
chromereleases.googleblog.com · 34d ago · September 9th, 2026
-
mentioned by chromereleases.googleblog.com
Google Chrome # zeroday Google is aware that an exploit for CVE-2026-87491 exists in the wild. https:// chromereleases.googleblog.com/ 2026/
chromereleases.googleblog.com · 34d ago · September 9th, 2026
-
update from threat-intelligence.redeyesecurity.com
Chrome V8 zero-day CVE-2026-87491 is being exploited in the wild. Patch to 153.0.8010.36. V8 vulnerabilities turn a single visited page into
threat-intelligence.redeyesecurity.com · 34d ago · September 9th, 2026
Patch to 153.0.8010.36. V8 vulnerabilities turn a single visited page into
via Mastodon https://threat-intelligence.redeyesecurity.com/blog/chrome-v8-zero-day-cve-2026-87491-2026
-
update from bleepingcomputer.com
Google warns of new Chrome zero-day bug exploited in attacks
bleepingcomputer.com · 34d ago · September 9th, 2026
submitted by /u/homothebrave [link] [comments]
via reddit r/cybersecurity: Google warns of new Chrome zero-day bug exploited in attacks
-
mentioned by thehackernews.com
🤖 CVE-2026-87491: out-of-bounds write in Chrome's V8 engine, exploited in the wild, enables code execution inside the sandbox. Patched in Go
thehackernews.com · 34d ago · September 9th, 2026
-
mentioned by beyondmachines.net
Google Patches Chrome Zero-Day and 229 Other Flaws in Version 153 Google released Chrome 153 to fix 230 vulnerabilities, including an active
beyondmachines.net · 33d ago · September 10th, 2026
-
update from www.golem.de
One wrong click is enough: Google warns of malware attacks on Chrome users - Golem.de
www.golem.de · 30d ago · September 13th, 2026
Ein falscher Klick genügt: Google warnt vor Schadcode-Attacken auf Chrome-Nutzer - Golem.de https://www.
-
mentioned by securityonline.info
A Google Pixel vulnerability exploited in targeted attacks allows privilege escalation. Update your device to patch this Google Pixel vulner
securityonline.info · 28d ago · September 16th, 2026
-
update from cyberpress.org
Google Chrome 153 Fixes 42 Security Flaws, Including Critical WebGL and Use-After-Free Bugs
cyberpress.org · 28d ago · September 16th, 2026
WebGL exposes GPU-accelerated graphics capabilities to web content, making memory-safety defects in this component particularly important in browser attack scenarios. Chrome 153 also resolves CVE-2026-91721, a use-after-free flaw in Internals, and CVE-2026-91749, a use-after-free issue in Workers. However, multiple c
-
mentioned by gbhackers.com
Google Chrome 153 Released With Fixes for 42 Security Vulnerabilities
gbhackers.com · 28d ago · September 16th, 2026
-
mentioned by www.bleepingcomputer.com
Google fixes actively exploited Android zero-day on Pixel devices https:// bleepingcomputer.com/news/security/ google-fixes-actively-exploit
www.bleepingcomputer.com · 27d ago · September 16th, 2026
-
update from malware.news
Google Pixel owners urged to patch actively exploited modem flaw
malware.news · 27d ago · September 16th, 2026
After updating, check that the Android security update level shows September 5, 2026 , or later.
-
update from securityweek.com
Pixel Modem Zero-Day Exploited in Targeted Attacks
securityweek.com · 27d ago · September 16th, 2026
Google has not attributed the exploitation to a specific threat actor, but the modem-level, zero-click nature of the flaw and the company’s ‘limited, targeted’ framing are hallmarks of past attacks linked to commercial spyware vendors or state-sponsored actors. The critical flaws affect the multimedia subsystem, VPU, modem, telephone, bootloader, TEE, libpixelimsmedia, GDMC, GSA, GPCA, and other components.
-
mentioned by netguide.io
Google Warns of Active Exploitation of Modem Vulnerability in Pixel Smartphones Google is warning of a critical security flaw in the modem o
netguide.io · 27d ago · September 16th, 2026
-
mentioned by netguide.io
Google Chrome: Update Patches 42 Security Vulnerabilities on Desktop Google has released a major security update for Chrome. The patch addre
netguide.io · 27d ago · September 16th, 2026
-
update from netguide.io
Google warns of active exploitation of modem vulnerability in Pixel smartphones
netguide.io · 27d ago · September 16th, 2026
Google warns of a dangerous security vulnerability in the modem components of Pixel smartphones that, according to available reports, is already being actively exploited by attackers. Why modem vulnerabilities are particularly critical:
Modem components of smartphones are considered highly sensitive parts of the device architecture. Without protective software updates, the gateway for attacks remains potentially open. Recommendation: How Pixel users can protect themselves:
Owners of Google Pixel smartphones should keep an eye on the update status. It is recommended to manually check the update status: - Open the device Settings on your Pixel smartphone. - Navigate to the System menu and select Software update (or System update). - If an update is displayed, download it immediately and restart the device after installation. Users should ensure that automatic system and security updates remain enabled in the settings.
-
update from netguide.io
Google Chrome: Update patches 42 security vulnerabilities on desktop
netguide.io · 27d ago · September 16th, 2026
Since several of the fixed bugs have a high threat potential, desktop users should install the update promptly. In addition, numerous other vulnerabilities were eliminated that Google classifies with the second-highest severity level "High." Exact technical details on the attack vectors are being withheld by the company as usual until a large portion of the user base has installed the corrected browser version. This prevents cybercriminals from specifically exploiting the errors before protective measures take effect. Regular patches protect against web threats:
Web browsers are the central gateway for threats from the Internet, as they constantly process foreign code from visited websites. Quick responses to security vulnerabilities and consistent browser-side protection are therefore essential. If you do not want to wait for automatic background distribution, you can start the installation process manually: 1. Click the three-dot menu in the top right corner of the browser window. Select the Help menu item. Chrome then immediately checks for available versions and downloads the update.
-
update from secdb.nttzen.cloud
🚨 [CISA-2026:0916] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
secdb.nttzen.cloud · 27d ago · September 16th, 2026
🚨 [CISA-2026:0916] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
via Mastodon https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0916
-
mentioned by go.dhs.gov
We added Google Pixel improper authorization vulnerability CVE-2026-58704 to our KEV Catalog. Visit https:// go.dhs.gov/Z3Q & apply mitigati
go.dhs.gov · 27d ago · September 16th, 2026
-
update from www.bleepingcomputer.com
Reward: You've received the Unwanted Tutorial Badge and a complimentary 110-vulnerability patch drop. https://www. bleepingcomputer.com/news
www.bleepingcomputer.com · 27d ago · September 16th, 2026
Reward: You've received the Unwanted Tutorial Badge and a complimentary 110-vulnerability patch drop.
-
mentioned by www.theregister.com
Update early, update often! "CVE-2026-85046 is a type confusion flaw in Chromium’s V8 JavaScript engine that allows remote attackers to exec
www.theregister.com · 27d ago · September 16th, 2026
-
mentioned by securityexpress.info
Google confirmed a Pixel modem zero-day (CVE-2026-58704) exploited in a zero-click spyware attack to escape the modem sandbox. Update now. #
securityexpress.info · 27d ago · September 17th, 2026
-
mentioned by cyberwald.com
Cyberwald Cybersecurity News - 17.09.2026 Today's podcast: Google Pixel Modem Zero-Day CVE-2026-58704 actively exploited
cyberwald.com · 26d ago · September 17th, 2026
-
mentioned by beyondmachines.net
Google Patches Pixel Modem Zero-Day Exploited in Targeted Attacks Google's September 2026 update for Pixel devices fixes 110 vulnerabilities
beyondmachines.net · 26d ago · September 17th, 2026
-
update from socprime.com
CVE-2026-58704: Google Pixel Modem Zero-Day Exploited in Targeted Attacks
socprime.com · 26d ago · September 17th, 2026
That zero-click characteristic significantly raises the operational risk. Unlike common mobile attacks that depend on social engineering, a modem-level vulnerability may potentially be triggered through communications processed below the normal application layer, reducing the opportunities for users to recognize or stop an attack before exploitation occurs. Google has not publicly described the delivery mechanism used in the observed campaign.
-
update from dev.to
1. Basic Information Original Title: Pixel Update Bulletin—September 2026 Source:... # security # threatintel # software # coding # developm
dev.to · 26d ago · September 17th, 2026
security # threatintel # software # coding # developm
via Mastodon https://dev.to/anoymask/google-pixel-cve-2026-58704-limited-active-exploitation-of-modem-authorization-bypass-1ep
-
mentioned by www.bleepingcomputer.com
# Google fixes actively exploited # Android zero-day on # Pixel devices https://www. bleepingcomputer.com/news/secu rity/google-fixes-active
www.bleepingcomputer.com · 26d ago · September 17th, 2026
-
update from kulturegeek.fr
[VULN] Google confirms Pixel phones hacked via modem zero-day - CVE-2026-58704
kulturegeek.fr · 25d ago · September 18th, 2026
Exploitation requires no user interaction: the user does not need to click a link, open a file, or approve a permission. It does not alone constitute proof of full remote access to all phone data: Google's limited information shows mainly that an attacker can bypass modem restrictions and obtain additional privileges. via KultureGeek https://kulturegeek.fr/news-359668/google-confirme-piratage-pixel-via-faille-modem
-
mentioned by www.cve.org
New. CISA Adds Two Known Exploited Vulnerabilities to Catalog. CVE-2025-39964 Linux Kernel Race Condition Vulnerability https://www. cve.org
www.cve.org · 25d ago · September 18th, 2026
-
update from go.dhs.gov
We added Linux Kernel improper check for unusual or exceptional conditions vulnerability CVE-2025-39682 to our KEV Catalog. Visit https:// g
go.dhs.gov · 25d ago · September 18th, 2026
We added Linux Kernel improper check for unusual or exceptional conditions vulnerability CVE-2025-39682 to our KEV Catalog.
-
mentioned by cybersecurefox.com
CVE-2026-58704: Pixel modem vulnerability added to CISA KEV catalog 🔗 https:// cybersecurefox.com/en/cve-2026 -58704-pixel-modem-privilege-e
cybersecurefox.com · 23d ago · September 20th, 2026
-
mentioned by source.android.com
:androidalt: Google fixes actively exploited Android Zero-Day on Pixel Devices. Google has released the September 2026 security patches to a
source.android.com · 21d ago · September 22nd, 2026