Google Pixel Zero-Day Modem Exploit Targets Owners in Limited Attacks

TL;DR

• Google has confirmed a zero-day flaw in the Samsung Exynos modem used in many Pixel phones was abused in limited, targeted attacks that could hijack devices over the cellular network with no user interaction.
• The issue affects Pixel 6 through Pixel 9 series devices, and is fixed in the September 2026 Pixel security update with patch level 2026-09-05 or later.
• Pixel owners should update immediately via Settings, reboot, and turn off 2G and automatic network selection extras to reduce baseband attack surface until patched.

What Happened: Google Confirms Targeted Exploitation

Google has confirmed that some Pixel owners were hacked through a critical modem vulnerability that was exploited as a zero-day in the wild. In its September 2026 Pixel Update Bulletin and Android Security Bulletin, released this week, Google flagged the baseband flaw as under limited, targeted exploitation.

That language is significant. Google only uses it when its Threat Analysis Group or external security partners have seen real-world attacks, not just theoretical proof-of-concept code. The company did not name the victims or attribute the activity to a specific spyware vendor or state actor, but said the attacks were narrow and highly targeted rather than widespread.

The disclosure follows a pattern seen with previous baseband bugs: silent, over-the-air exploitation that leaves little trace for the victim.

The Vulnerability Explained: Remote Code Execution in the Baseband

At the core of the incident is a remote code execution vulnerability in the Samsung Exynos modem firmware that handles all cellular communications on affected Pixels.

Unlike an app bug or browser flaw, a modem vulnerability lives in the baseband processor, a separate chip that is always on and always listening to cell towers. According to Google's description, a remote attacker within radio range or operating a rogue base station could send specially crafted signaling messages over LTE and 5G to corrupt modem memory and gain code execution.

That is especially dangerous for three reasons:

1. Zero-click: No phishing link, attachment, or call pickup is required. Just having cellular service enabled is enough.
2. Invisible: Baseband crashes often look like a brief signal drop, so victims would not see a typical hack warning.
3. Privileged: Once inside the modem, an attacker can potentially pivot to the main Android OS, intercept calls and SMS including 2FA codes, track location, or deploy further spyware.

Google rated the flaw as Critical / High severity for the modem component and noted that exploitation required no additional user privileges. A fix was developed with Samsung and rolled into the closed-source modem firmware bundled with the September Pixel update.

Which Pixel Models Are At Risk

The flaw affects Pixel phones that use Samsung Exynos modems, which covers almost every Tensor-powered Pixel to date:

At risk: Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, and Pixel 9a

Not affected in the same way: Pixel 10 series and newer, which switched to a MediaTek-based modem, and the older Pixel 5a and earlier, which used Qualcomm modems. Pixel Watch with cellular and some Samsung Exynos devices share similar modem code and may need separate carrier updates.

If you own a Pixel 6 through Pixel 9, assume you were vulnerable until you install the September 2026 patch. Google says devices that are already on security patch level 2026-09-05 or later are protected.

How to Check for Updates and Secure Your Device Right Now

Do not wait for the auto-update notification. The fix is rolling out now via OTA, but carrier delays mean you should manually check.

How to check your patch level and update:

1. Open Settings > System > Software updates > System update > Check for update
2. Also check Settings > Security & privacy > System & updates > Security update to confirm your Android security patch level reads 2026-09-05 or later
3. Tap Download and Install, then Restart when prompted. Modem firmware only fully applies after a reboot.
4. If you manage multiple Pixels, repeat on each device. Google Fi and unlocked models are first, followed by carrier-locked models.

If no update is available yet for your carrier, take these hardening steps in the meantime:

Turn off 2G: Go to Settings > Network & internet > SIMs > Allow 2G and toggle it off. 2G has weak authentication and is commonly abused to force downgrade attacks.

Keep auto-updates on: Enable Settings > System > Software updates > Auto-download over Wi-Fi.

Reboot regularly and watch for warning signs: Unexpected baseband crashes, sudden reboots, signal loss in strong coverage areas, or battery drain after travel can be indicators of baseband instability.

Use secure communications: Until patched, prefer encrypted calling and messaging over data rather than traditional voice/SMS for sensitive conversations.

What Google and Carriers Are Doing Next

Google says it has notified carriers and released updated modem binaries to Pixel partners. The September 2026 update includes two patch levels - 2026-09-01 for the Android framework and 2026-09-05 for the closed-source modem and other vendor components. You need the second one to be safe.

Security researchers are urging all Pixel 6 to 9 owners to update within 24-48 hours, even if they do not consider themselves high-risk targets. While Google describes the current exploitation as limited and targeted - typically aimed at journalists, activists, executives, or political figures - the technical details of baseband flaws often become more widely understood after disclosure, raising the risk of broader copycat attacks.

Google also recommends enrolling in Advanced Protection and enabling automatic security updates if you are at elevated risk. The company says it will share more technical details through its Project Zero blog after most devices have had time to update, to avoid helping attackers.

Bottom line: If you have a Tensor-powered Pixel from the last four years, open Settings and update today.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.