Google and Apple are patching a smartphone vulnerability that can be exploited without the victim having to do anything. At Google, this has already effectively occurred.
The vulnerability that stands out in the September 15 Pixel Update Bulletin is labeled CVE-2026-58704. It concerns a privilege escalation in the mobile modem of Pixel devices, caused by flawed authorization. Google itself maintains a cautious formulation: there are indications that the vulnerability is being exploited in a ‘limited but targeted’ manner.
Attack without a single tap
What makes the leak dangerous is that no user action is involved. No link to click, no file to open: an attacker reaches the modem directly and subsequently breaks out of the sandbox in which it runs, toward the data on the rest of the device. This profile is the trademark of commercial spyware providers serving governments and investigative services. Google does not identify perpetrators and does not say who was targeted.
A patch for the vulnerability was rolled out in early September, which also immediately covers the more than one hundred other vulnerabilities in Android. All supported Pixel devices receive the update directly from Google; other Android manufacturers must first process it into their own software skins. This traditionally causes some delay.
Bluetooth vulnerability at Apple
On Monday, following the launch of new iPhones, Apple released iOS 26.7 and iPadOS 26.7, together accounting for over eighty patched vulnerabilities. The most severe is CVE-2026-65414, a vulnerability linked to Bluetooth. In Apple’s own words, an attacker can cause an app to crash or execute arbitrary code via Bluetooth.
The CVSS score of 9.8 indicates a serious vulnerability, as no user interaction is required here either. Apple reports no active exploitation. The patches therefore serve primarily as prevention, and it is best to install them as soon as possible.
The Bluetooth vulnerability also affects macOS, tvOS, watchOS, and visionOS. Apple rolled out an update for all its operating systems this week.