Google has confirmed that a high-severity Android zero-day vulnerability affecting Pixel smartphones is being actively exploited in the wild This article explores 110 vulnerabilities pixel. . According to the advisory, "In Cellular Modem, there is a possible permission bypass due to a logic error in the code," which could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed.
An attacker on an adjacent network or within radio range of the target, already possessing basic privileges, can quietly escalate access. Google notes the exploit is low in complexity and requires no user interaction, making it easy for a victim to be exploited without needing to click a link, install an app, or make a mistake.
The "limited, targeted" language Google uses is reminiscent of zero-day exploits historically used by commercial spyware vendors and state-aligned surveillance operators, suggesting a narrow but high-value target audience rather than widespread exploitation. As per the official advisory issued by Google, the September 2026 Pixel bulletin, published on September 15, includes the patching of a total of 110 vulnerabilities on Pixel hardware, including 12 remote code execution and 89 privilege-escalation issues rated as critical or high. The Pixel patches build upon the wider September 2026 Android update, which SecurityWeek reported addressed roughly 180 vulnerabilities across the ecosystem, including dozens of critical flaws such as the Wi-Fi memory-corruption bug CVE-2026-28662.
