Skip to content
Hermes Codex

CVE-2026-58704: Zero-Click Adjacent Privilege Escalation in Google Pixel Cellular Modem

HERMES

HERMES THREAT SCORE & CELLULAR ZERO-CLICK PERIMETER RISK

Target: Google Pixel Devices (Pixel 6 through 9 Series) — Shannon Baseband Modem Firmware & IPC Stack
Confidence: 98%
94 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 19 / 20
Threat Activity 19 / 20
Weaponization 19 / 20
Exposure 18 / 20
Prevalence 18 / 20
Impact 19 / 20
Exploit Maturity 19 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

While CVSS v3.1 rates CVE-2026-58704 at 8.0 (High, AV:A), Hermes classifies the risk as CRITICAL (94). Baseband cellular modem compromises bypass all Android OS sandbox barriers, SELinux enforcement policies, and application-level encryption. Threat actors possessing IMSI-catcher infrastructure or commercial spyware tooling can remotely compromise target mobile devices over radio frequencies without any user interaction or device notification.

HASS

HASS AGENTIC SEVERITY & MOBILE HARDWARE SUBVERSION

Target: Cellular Radio Subsystem, Radio Interface Layer (RIL) & Android IPC Bus
Confidence: 92%
78 / 100
HIGH

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 14 / 20
Tool Access 16 / 20
Privilege 17 / 15
Persistence 13 / 15
External Impact 14 / 15
Propagation 12 / 15
⚖️ Divergence & Operational Rationale

The cellular baseband operates as an independent real-time computing environment possessing direct memory access (DMA) to shared system memory buses. Exploiting the baseband modem grants persistent hardware-level positioning, SMS/voice interception, and a direct launchpad to compromise the primary Android Application Processor (AP).

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-58704: Zero-Click Adjacent Privilege Escalation in Google Pixel Cellular ModemVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTLinux Kernel Core
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Linux Kernel Core documented in Hermes dossier.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”

The baseband processor runs an independent real-time operating system (RTOS) that processes all RF signals, cellular handovers, and telephony protocols completely isolated from the main Android Linux kernel.

ParameterTechnical SpecificationOperational Significance
CVE IdentifierCVE-2026-58704Google Pixel Security Bulletin (September 2026) / CISA KEV
Vulnerability ClassAuthorization Bypass / Modem Logic Error (CWE-863)Flaw in baseband cellular frame authorization pipeline
Affected ComponentShannon / Tensor Cellular Baseband Modem StackReal-time signaling decoder (RRC/NAS message handlers)
Trigger MechanismMalformed cellular signaling frames over RF linkOver-the-air transmission via adjacent rogue base station
Authentication RequiredNone (PR:N)Radio link establishment without SIM authentication
User InteractionZero-Click (UI:N)Silent background cellular negotiation
Attack VectorAdjacent Radio Network (AV:A)Exploited over LTE / 5G cellular frequencies
Privileges ObtainedBaseband Firmware Execution & Adjacent EscalationDMA access and IPC communication to Android Application Processor
CISA KEV StatusListed (Added September 12, 2026)Federal directive deadline: September 19, 2026
Affected DevicesGoogle Pixel 6, 6 Pro, 6a, 7, 7 Pro, 7a, 8, 8 Pro, 8a, 9, 9 ProTensor-powered devices with Shannon modems
Remediation TargetSecurity Patch Level 2026-09-05 (or later)Firmware hotfix distributed via Android OTA update

2. Vulnerability Anatomy & Root Cause Analysis

Section titled “2. Vulnerability Anatomy & Root Cause Analysis”

Shannon Baseband Protocol Stack Vulnerability

Section titled “Shannon Baseband Protocol Stack Vulnerability”

Cellular communication relies on complex, hierarchical state machines defined by 3GPP standards. During connection setup and mobility handovers, the modem exchanges Radio Resource Control (RRC) and Non-Access Stratum (NAS) messages with the cell tower.

In the Shannon modem architecture, incoming signaling packets are processed by a dedicated hardware DSP and passed to the modem firmware running on an ARM Cortex-R real-time core.

Prior to the September 2026 security patch:

  1. When handling specific mobility or re-establishment requests from an adjacent base station, the modem state machine failed to properly enforce cryptographic authentication requirements for certain proprietary or optional message fields.
  2. A logic error in the authorization routine allowed malformed NAS message elements to be parsed before security context activation (SecurityModeComplete).
  3. This unauthenticated parsing state triggered an out-of-bounds structure write in the baseband heap, allowing the adjacent attacker to overwrite memory pointers and redirect control flow within the modem RTOS.
// Conceptual depiction of the vulnerable signaling parser logic
int process_nas_mobility_message(uint8_t *buffer, size_t len, security_context_t *sec_ctx) {
    nas_header_t *hdr = (nas_header_t *)buffer;


    // VULNERABILITY: Security context check bypassed for malformed extension headers
    if (hdr->msg_type == NAS_EXT_SIGNALLING_REQ) {
        // Logic error: processes unencrypted message payload prior to security activation
        return parse_unauthenticated_signalling_blob(buffer + sizeof(nas_header_t), len);
    }


    if (!sec_ctx->is_authenticated) {
        return ERR_SECURITY_VIOLATION;
    }
    return parse_secure_nas_payload(buffer, len);
}

Once execution is achieved within the baseband processor:

  • The attacker commands the modem to monitor or manipulate all voice and SMS streams.
  • The attacker utilizes the shared PCIe / shared-memory IPC channels between the baseband modem and the Google Tensor Application Processor (AP) to launch secondary privilege escalation exploits against the Android kernel.

3. Attack Flow & Weaponization Mechanics

Section titled “3. Attack Flow & Weaponization Mechanics”
sequenceDiagram
    autonumber
    actor Attacker as Rogue Base Station (IMSI Catcher / gNodeB)
    participant Modem as Pixel Baseband Processor (Shannon RTOS)
    participant AP as Android Application Processor (Linux Kernel)
    participant User as Target User (Pixel Device)


    Attacker->>Modem: Transmit high-power cellular beacon (forced cell reselection)
    Modem->>Attacker: Initiate RRC Connection Request
    Attacker->>Modem: Transmit malformed RRC/NAS signaling frame (CVE-2026-58704)
    Note over Modem: Logic error bypasses security checks prior to authentication
    Modem->>Modem: Out-of-bounds heap corruption in baseband RTOS
    Modem->>Modem: Attacker achieves arbitrary code execution in baseband
    Modem->>AP: Inject malicious payload across shared memory / RIL IPC interface
    Note over User: Attack executes silently with ZERO notification or screen wake
    Modem->>Attacker: Stream call audio, SMS tokens, and precise GPS telemetry

4. Detection Engineering & Forensic Triage

Section titled “4. Detection Engineering & Forensic Triage”
Terminal window
## Filter radio interface layer logs for baseband crash signatures
adb logcat -b radio | grep -E "RILC|RILJ|MODEM_CRASH|SHANNON|SSR"


## Look for unexpected Radio Subsystem Restart (SSR) events
adb shell dmesg | grep -iE "subsystem_restart|modem|remoteproc"


## Dump modem crash diagnostic files from vendor partition
adb root
adb shell ls -la /data/vendor/radio/crash_dump/
adb shell ls -la /data/vendor/modem_dump/

5. Forensic Investigation & Incident Response Playbook

Section titled “5. Forensic Investigation & Incident Response Playbook”

When investigating suspected mobile spyware or adjacent cellular compromise on Google Pixel devices:

  1. Bugreport & Memory Dump Extraction: Generate a comprehensive Android bugreport via ADB immediately upon seizing the device:
    Terminal window
    adb bugreport pixel_triage_cve_2026_58704.zip
  2. Analysis of Radio Dump Artifacts: Inspect the extracted archive for:
    • FS/data/vendor/radio/: Contains persistent baseband crash dumps and modem error logs.
    • radio.txt: Complete logcat dump of the radio buffer documenting signaling transactions leading up to the incident.
  3. Firmware Version Verification: Verify the installed baseband firmware version against known patched builds:
    Terminal window
    adb shell getprop gsm.version.baseband
  4. Physical Isolation & Shielding: If a device is suspected of active cellular exploitation, place it immediately in an RF-shielded Faraday bag or room to sever radio link connectivity without powering down volatile state.

6. Remediation, Patching & Hardening

Section titled “6. Remediation, Patching & Hardening”

  1. Apply the September 2026 Android Security Update: Update target Pixel devices to security patch level 2026-09-05 or later:

    • Navigate to Settings > Security & privacy > System & updates > Security update.
    • Verify that the Android security patch level displays September 5, 2026 or later.

  2. Disable 2G Radio Connections: Mitigate rogue base station downgrades by disabling 2G connectivity on Android:

    • Navigate to Settings > Network & internet > SIMs > [Select SIM] > Allow 2G and toggle to Disabled.

  3. Deploy Private Cellular / Enterprise APN Controls: For enterprise-managed mobile fleets (MDM/UEM), enforce profiles that mandate modern mutual authentication (5G Standalone) and prohibit connection to untrusted microcells.

7. Related Intelligence & Attack Paths

Section titled “7. Related Intelligence & Attack Paths”
Linux Forensics & Mobile Kernel Analysis Analyze low-level memory artifacts, SELinux enforcement, and kernel exploitation.
Initial Access Brokers & Mobile Spyware Review how advanced threat actors operationalize zero-click mobile exploits.
Cisco Secure Email Zero-Click RCE (CVE-2026-76461) Analyze another critical zero-click perimeter exploitation vector.