EUVD-2026-79004
GHSA-chq2-jxgv-5vfw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttain radio proximity to device modem
-
DeliverySend crafted cellular signaling
-
ExploitTrigger logic-error permission bypass
-
ExecutionEscalate privileges within modem
-
ImpactCompromise modem confidentiality/integrity/availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires radio/RF proximity to the target's cellular modem (AV:A adjacent, not Internet-remote) - realistically a rogue base station or nearby malicious radio equipment communicating with the baseband. No authentication (PR:N) and no user interaction (UI:N) are required, and the attack works against affected default Android/Pixel modem firmware. The primary limiting factor is the adjacency requirement: an attacker must be physically within cellular range and able to inject crafted signaling; SSVC further notes the attack is non-automatable, indicating hands-on rather than scalable exploitation. Affected scope is Android devices per the Pixel 2026-09-01 bulletin. |
| Impact | This is a genuine priority, and among the more serious entries in the Pixel September 2026 cluster because it is NOT a local-only escalation: the CVSS vector is AV:A (adjacent/proximal), AC:L, PR:N, UI:N with C:H/I:H/A:H, meaning a nearby unauthenticated attacker with radio proximity to the cellular modem can bypass a permission check with no user interaction and gain total technical impact. Two signals strongly elevate it: CISA KEV lists it as actively exploited in the wild, and public exploit code is reported to exist. However, there is a clear conflict between signals that defenders must weigh: the CISA SSVC decision framework records Exploitation as 'none' and Automatable as 'no', and EPSS is very low at 0.11% (2nd percentile) - the opposite of what one expects for a KEV-listed flaw. The most coherent reading is that exploitation is real but targeted and manual (proximity + non-automatable modem attack) rather than widespread or wormable, which reconciles KEV=YES with low EPSS and SSVC Automatable=no. The C:H/I:H/A:H impact rating is generous Android-bulletin boilerplate, but for a baseband/modem permission bypass a high technical-impact rating (SSVC 'total') is defensible. Net: treat as a must-patch on affected Android/Pixel devices, but the adjacent (not remote-Internet) vector and non-automatable nature bound the realistic blast radius to attackers within RF range. |
| Exploit ScenarioDerived | An attacker within radio range of a target device (e.g. via a rogue/malicious base station or nearby malicious RF equipment) sends crafted signaling to the cellular modem, tripping a logic error that bypasses a permission check and grants elevated privileges within the modem with no user interaction. Public exploit code is reported to exist and CISA lists the flaw as actively exploited, though the SSVC framework marks it non-automatable, implying hands-on proximity-based use rather than mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Permission bypass in the cellular modem firmware of Google Android/Pixel devices allows a nearby unauthenticated attacker to escalate privileges without user interaction, achieving total technical impact (C:H/I:H/A:H) via crafted radio signaling. This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, though exploitation requires radio/RF proximity to the target baseband (adjacent, not Internet-remote) and SSVC deems it non-automatable. EPSS is low at 0.11% (2nd percentile).
Earlier versions of this analysis (1)
A permission bypass in the Android Cellular Modem (baseband) component lets an attacker who is within radio range of the device escalate privileges inside the modem context, exposing confidentiality, integrity and availability of device data with no user interaction. Exploitation requires the attacker to already hold low-level privileges on the modem interface (CVSS PR:L) and to be network-adjacent (AV:A), which in practice points to a rogue or compromised cellular base station rather than an internet-based attacker. The flaw stems from a logic error in permission checking rather than a memory-safety bug, and at time of analysis there is no public exploit code and no CISA KEV listing, though the vendor has published a fix in the September 2026 Pixel security bulletin that should be treated as authoritative.
RemediationAI
Patch available per vendor advisory: apply the September 2026 Pixel security update from Google (https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01). No exact fix version is provided in the available data. Because exploitation requires radio proximity to the cellular modem, there is no effective network-perimeter mitigation; however, users can reduce exposure by disabling cellular data or using Wi-Fi calling in high-risk locations, though this degrades connectivity. Ensuring devices are updated to the latest available security patch level is the primary remediation. Additional references: NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-58704) and VulDB (https://vuldb.com/vuln/404493).
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-285 improper authorization caused by a logic error in the cellular modem's permission-checking code. The affected component is the baseband firmware on Google Android/Pixel devices, as indicated by CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:* and EUVD's 'Android Android kernel'. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates the attack is launched from an adjacent network (e.g., a rogue base station or malicious radio equipment within cellular range), requires no authentication or user interaction, and results in high confidentiality, integrity, and availability impact. The logic error allows bypassing a permission check that would normally prevent unauthorized privilege escalation from the modem to the device.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent RF proximity to the modem gives AV:A; no auth or interaction (PR:N/UI:N); modem permission bypass yields high technical impact, so C/I/A:H, though this is generous bulletin boilerplate.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
4DescriptionCVE.org
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Technical POC Analysis
Evidence limitation up front: the supplied evidence is a single CISA KEV entry (plus its GCVE metadata).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A permission-bypass flaw in the cellular modem firmware used by Google Android/Pixel devices allows an attacker positioned within radio range to gain full control of the baseband processor, which in turn yields complete compromise of the handset without any user interaction. CISA has confirmed this is actively exploited, and no vendor patch exists today, so every Pixel and affected Android device in the fleet - including those used for privileged access, executive communications, and field operations - remains exposed purely by proximity. Leadership should treat this as a hardware-layer trust failure affecting mobile endpoints that carry corporate credentials and data, not as a routine software bug awaiting a routine update.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling or powering down the cellular radio (airplane mode) on affected devices, restricting their use for privileged or highly sensitive work, enforcing physical and RF proximity controls in sensitive facilities, substituting vetted alternative handsets for at-risk users, and monitoring device attestation for baseband tampering.
Threat Model
5 threats: Elevation of Privilege, Tampering, Information Disclosure and 2 more
5-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB