~/news/2026-09-16-google-pixel-kev.md

What happened. CISA added CVE-2026-58704, an improper-authorization flaw in Google Pixel devices, to the Known Exploited Vulnerabilities catalog. Membership there is not a prediction: it means CISA has evidence it is being exploited right now, not that someone might one day.

Why it matters. KEV is the one vulnerability list whose entry condition is "in use," not "disclosed." A phone with an actively exploited authorization flaw is almost always the signature of targeted attack rather than scanning noise, because mobile is expensive to attack and you do not spend that on someone random.

Mechanism. CISA labels it improper authorization, the missing-permission-check class: a door that opened without a key. The alert is deliberately thin beyond that: the component and the exact chain are in Google's Pixel bulletin. An authorization flaw on a device usually reads privilege escalation, a foothold getting more than it was given.

What to do. Patch, and do not stop at patching. BOD 26-04, the federal rule this sits under, explicitly requires checking whether the system was already compromised before you consider the patch the end of it. That order is the one most people skip: look for the actor first, and only then close the door.