\n security\n <\/p>\n
\n CISA gives federal agencies just 3 days to patch\n <\/p>\n
Both Google and Uncle Sam warned that attackers have exploited a zero-day improper authorization bug in Pixel phones’ cellular modems that can bypass permission checks and escalate privileges with no user interaction required. The hole has since been closed, provided that you update.<\/p>\n
Google disclosed<\/a> the high-severity vulnerability, tracked as CVE-2026-58704<\/a>, on Tuesday – and, at the time, warned the security hole \u201cmay be under limited, targeted exploitation.\u201d In other words: miscreants found and exploited this bug before Google fixed the issue.\u00a0<\/p>\n The Register reached out to Google for more details about the scope of exploitation, and how attackers are exploiting the flaw and what they can achieve.<\/p>\n We have very limited details about the vulnerability itself, other than that it exists in Pixel phones’ modems, is being exploited in the wild, and can be exploited in zero-click attacks, meaning no user interaction is required.<\/p>\n We do know, however, that these types of zero-click attacks<\/a> are frequently used by commercial spyware makers<\/a> to surveil targeted individuals<\/a>.\u00a0<\/p>\n On Wednesday, the US Cybersecurity and Infrastructure Security Agency (CISA) added the CVE to its Known Exploited Vulnerabilities Catalog<\/a> and gave federal agencies just three days – until September 19 – to patch the flaw.\u00a0<\/p>\n \u201cThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,\u201d according to the cyber-defense agency.<\/p>\n Earlier this month, CISA added two Google Chromium vulnerabilities, CVE-2026-85046<\/a> and CVE-2026-87491<\/a>, to its KEV catalog.\u00a0<\/p>\n