Google Pixel phones were reportedly hacked through a critical vulnerability in their modems.
Google released the Android 17 QPR1 update for Pixel phones on September 16, 2026, and while the update brought new features like Harry Potter themes and contact VIPs, there were also more than 200 security fixes under the hood. Google has now confirmed that some of the vulnerabilities patched in the update were exploited in “limited and targeted” cyberattacks.
As noted in the National Vulnerability Database (via TechCrunch), one of those vulnerabilities was related to the modem inside Pixel phones. For those unaware, the modem is one of the components responsible for cellular connectivity, allowing your phone to connect to mobile networks and access cellular data.
According to the report, the vulnerability was buried deep inside the software powering the cellular modem and could allow an attacker to bypass some of Android’s security protections. Once exploited, the attacker could potentially gain access to highly sensitive data stored on the device without the user’s permission.
The vulnerability was buried inside the Pixel modem
More concerningly, the user wouldn’t necessarily need to click a malicious link or download a file for the attack to work. The vulnerability could reportedly be exploited without any interaction from the user, in what’s commonly known as a “zero-click” attack.
The exact details of how the vulnerability was exploited remain unclear. We also don’t know which Pixel models were affected or exactly how many users were targeted. However, Google has confirmed that the vulnerability, tracked as CVE-2026-58704, was exploited in limited and targeted attacks before the fix was released.
Thankfully, Google has now patched the vulnerability with its latest software update. So if you haven’t installed the September 2026 security patch on your Pixel yet, it’s worth updating your phone as soon as possible.
You can manually check for the update by heading to Settings > System > Software updates > System update and installing the latest version if it hasn’t already appeared on your device.
Google hasn’t shared more details about the attacks or who was targeted at this point. If the company reveals more information, we’ll update this article accordingly. For now, the best thing Pixel owners can do is make sure their phones are running the latest security patch.
