Posted on

Google Pixel CVE-2026-58704 – Limited Targeted Zero-Click Modem Privilege Escalation

Threat Overview

Google’s September Pixel bulletin states there are indications CVE-2026-58704 may be under limited, targeted exploitation. The high-severity Pixel modem flaw is a permission-bypass elevation of privilege. Public CVE data describes adjacent or proximal exploitation with no user interaction. CISA added the vulnerability to KEV on September 16. Google has not disclosed attacker identity, exploitation chain, victim population, or IOCs.

References

Impacted Systems

Supported Google Pixel devices, Pixel modem component. CVE-2026-58704 is a high-severity elevation-of-privilege vulnerability requiring no user interaction. Google does not publish a model-specific affected-device matrix for this CVE in the bulletin. Security patch level 2026-09-05 or later addresses the issues in the bulletin. The cited vulnerability is Pixel-specific and should not be generalized to unrelated Android OEM devices.

Why this matters

No-interaction mobile exploitation is especially relevant to executives, administrators, incident responders, and other high-value users. Public technical detail is extremely limited, so asset identification and patch validation are more reliable than IOC hunting.

Exploitation Status

Google says there are indications of limited targeted exploitation. CISA added CVE-2026-58704 to KEV. No public IOC, exploit chain, malicious application, domain, phone number, base-station indicator, or attacker attribution is available.

What this hunt looks for

This hunt identifies managed Pixel devices and then pivots to indirect post-compromise identity signals such as new sign-in IPs, risky sign-ins, and authentication-method changes. These queries do not claim to detect modem exploitation itself.

Required logs

IntuneDevices plus Entra SigninLogs and AuditLogs where ingested into Microsoft Sentinel. Specialized mobile telemetry would be required for direct modem-level exploitation visibility.

First Pass – Pixel Device Inventory

IntuneDevices
| where TimeGenerated >= ago(30d)
| where Manufacturer =~ "Google" or Model has "Pixel"
| summarize arg_max(TimeGenerated, *) by DeviceId
| project TimeGenerated,DeviceName,UserEmail,Manufacturer,Model,OS,OSVersion,ComplianceState,LastContact
| order by TimeGenerated desc

Pixel Devices by User

IntuneDevices
| where TimeGenerated >= ago(30d)
| where Manufacturer =~ "Google" or Model has "Pixel"
| summarize LastSeen=max(TimeGenerated),Devices=make_set(DeviceName,20),Models=make_set(Model,20),OSVersions=make_set(OSVersion,20) by UserEmail
| order by LastSeen desc

Pixel Users Recent Entra Sign-Ins

let PixelUsers=IntuneDevices
| where TimeGenerated >= ago(30d)
| where Manufacturer =~ "Google" or Model has "Pixel"
| summarize by UserEmail;
SigninLogs
| where TimeGenerated >= ago(14d)
| join kind=inner PixelUsers on $left.UserPrincipalName == $right.UserEmail
| project TimeGenerated,UserPrincipalName,IPAddress,AppDisplayName,ClientAppUsed,DeviceDetail,LocationDetails,ResultType,ResultDescription
| order by TimeGenerated desc

New Sign-In IPs for Pixel Users

let PixelUsers=IntuneDevices
| where TimeGenerated >= ago(30d)
| where Manufacturer =~ "Google" or Model has "Pixel"
| summarize by UserEmail;
let Known=SigninLogs
| where TimeGenerated between (ago(30d)..ago(2d))
| join kind=inner PixelUsers on $left.UserPrincipalName == $right.UserEmail
| summarize by UserPrincipalName,IPAddress;
SigninLogs
| where TimeGenerated >= ago(2d)
| join kind=inner PixelUsers on $left.UserPrincipalName == $right.UserEmail
| join kind=leftanti Known on UserPrincipalName,IPAddress
| project TimeGenerated,UserPrincipalName,IPAddress,AppDisplayName,ClientAppUsed,DeviceDetail,LocationDetails,ResultType
| order by TimeGenerated desc

Risky Sign-Ins for Pixel Users

let PixelUsers=IntuneDevices
| where TimeGenerated >= ago(30d)
| where Manufacturer =~ "Google" or Model has "Pixel"
| summarize by UserEmail;
SigninLogs
| where TimeGenerated >= ago(14d)
| join kind=inner PixelUsers on $left.UserPrincipalName == $right.UserEmail
| where RiskLevelDuringSignIn !in~ ("none","hidden","")
| project TimeGenerated,UserPrincipalName,IPAddress,AppDisplayName,RiskLevelDuringSignIn,RiskState,RiskDetail,DeviceDetail,LocationDetails
| order by TimeGenerated desc

Detection Notes

The first-pass hunt is asset identification, not exploit detection. There is no public Sentinel-visible exploit signature. Identity anomalies after a mobile compromise are indirect and can have benign causes. OS version is not equivalent to Android security patch level, so patch status should be verified through mobile management or directly on the device.

Leave a comment