# Google Pixel patch addresses actively exploited vulnerabilities

Published: 2026-09-16 · Severity: severe
Canonical: https://vorant.io/reports/2e581c80-eeae-5bbb-97e2-026a4c25d4d0/google-pixel-patch-addresses-actively-exploited-vulnerabilities

> Google released emergency patches for multiple Google Pixel vulnerabilities, including CVE-2026-58704 which is actively being exploited.

CERT-FR has issued an advisory covering multiple vulnerabilities discovered in Google Pixel devices. The advisory warns of multiple security flaws affecting all versions of Google Pixel without the September 15, 2026 security patch. The vulnerabilities enable remote code execution, privilege escalation, denial of service, and unauthorized access to data. Google has confirmed that CVE-2026-58704 is under active exploitation in the wild. The advisory references 94 individual CVE identifiers, spanning a broad range of vulnerability classes across the Pixel hardware and software stack. Organizations and individuals with Pixel devices should prioritize applying the emergency security update from September 15, 2026 or later.

## Mentioned in this report

- Vulnerabilities: CVE-2026-0159, CVE-2026-0170, CVE-2026-0171, CVE-2026-0177, CVE-2026-0179, CVE-2026-0183, CVE-2026-0186, CVE-2026-0187, CVE-2026-0189, CVE-2026-0192, CVE-2026-0194, CVE-2026-0197, CVE-2026-0199, CVE-2026-0200, CVE-2026-28589, CVE-2026-55301, CVE-2026-55302, CVE-2026-55304, CVE-2026-55305, CVE-2026-55306, CVE-2026-55317, CVE-2026-55318, CVE-2026-55323, CVE-2026-55326, CVE-2026-55329, CVE-2026-55331, CVE-2026-55332, CVE-2026-55337, CVE-2026-55343, CVE-2026-55351, CVE-2026-55355, CVE-2026-55357, CVE-2026-55358, CVE-2026-55359, CVE-2026-55364, CVE-2026-55365, CVE-2026-55366, CVE-2026-56879, CVE-2026-56881, CVE-2026-58704 (KEV)

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1176

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2e581c80-eeae-5bbb-97e2-026a4c25d4d0/google-pixel-patch-addresses-actively-exploited-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup