Pixel modem remote code execution

CVE-2026-0114 technical analysis

CVE-2026-0114 is a critical-severity Android vulnerability tracked as RCE. The published record describes pixel modem remote code execution affecting Supported Google Pixel devices. In practical terms, the vulnerability should be evaluated as a specific weakness in a specific component—not as automatic evidence that every affected device can be fully compromised. The execution context, reachable interface, platform mitigations, and availability of a reliable exploit chain all shape real-world risk.

This defect is in the Pixel modem, or baseband—the firmware on the cellular processor that parses radio-layer protocols, and one of the few components reachable over the air with no interaction from the user. That reachability is why Google rates it Critical: baseband RCE does not depend on a malicious app or a tapped link, and the modem runs on its own processor alongside, but distinct from, the Android application processor. Compromise is therefore scoped to the modem's context rather than automatically to Android userspace; escalation to the application processor would require a separate boundary-crossing bug not described in this record, which remains limited to Google's Pixel bulletin. For CVE-2026-0114, the confirmed impact recorded is: Remote code execution within the affected modem component.

This record lists 2026-03-01 as the public disclosure or patch date, identifies Not publicly disclosed as the discovery information currently available, and credits Google Pixel Security Team. The remediation recorded for affected users is March 2026 Pixel Update Bulletin. Use the references at the end of this page as the authoritative source, because vendors can revise advisories after publication.

Attack surface and exploitation prerequisites

The delivery path matters as much as the memory-safety or logic flaw. Researchers should establish whether the vulnerable component accepts network, browser, message, media, radio, or adjacent-device input and whether any user interaction is required. An RCE in a restricted service is not automatically equivalent to full device compromise.

A defensible assessment separates reachability, exploitation, and post-exploitation, so a component-level flaw is not described as an end-to-end device takeover. Compensating controls—network segmentation, application allow-listing, restricted messaging or browsing features, and MDM-enforced patching—can reduce exposure, but the durable resolution remains the vendor update identified in this record.

Detection and forensic triage

Baseband compromise is among the hardest classes to observe from Android, because the modem runs firmware the application processor does not fully instrument. There is rarely a user-visible symptom; triage relies on modem crash logs and radio diagnostics where the device exposes them, unexplained connectivity resets, and confirming the Pixel security patch level is 2026-03-05 or later. Because the vector is over-the-air and pre-interaction, physical possession is not required for exposure, and a device suspected of targeted attack should be preserved and, where the threat model warrants, kept off cellular radios during acquisition.

Absence of a visible symptom does not prove absence of exploitation, and a crash alone does not prove compromise. Preserve device state, record the operating-system build and patch level, and acquire logs using a method appropriate to the legal context—resetting or repeatedly testing the device can destroy useful traces. When assessing a suspected targeted attack, correlate device evidence with account sign-ins, messaging metadata, network telemetry, and MDM events to separate attempted delivery from successful exploitation.

How to mitigate CVE-2026-0114

The primary mitigation is straightforward: Install the March 2026 Pixel update with security patch level 2026-03-05 or later.

On Android, record both the Android version and the security patch level because the operating-system number alone does not prove that a fix is present. OEM and chipset bulletins may ship on different schedules. Google Play system updates can repair selected modular components, while firmware, kernel, and modem fixes usually depend on the device manufacturer.

1. Identify the exact device model, operating-system build, and current security patch level.
2. Compare that information with the affected range and fixed release documented by the vendor.
3. Back up necessary evidence before making changes when compromise is suspected.
4. Install the latest supported security release rather than stopping at the first version that mentions the CVE.
5. Verify the installed build after reboot and review related accounts and applications for follow-on activity.

PoC interpretation and research notes

This page distinguishes public disclosure from independent reproduction. Its current status is Vendor confirmed. Confirmed in Google's Pixel bulletin. The associated Android bug is not publicly available. Any PoC shown above should be reviewed in an isolated lab and used only on systems the researcher owns or is explicitly authorized to test. Public availability is not a guarantee that code is safe, complete, or accurately attributed.

Frequently asked questions about CVE-2026-0114

What is CVE-2026-0114?

CVE-2026-0114 is a Android RCE vulnerability associated with pixel modem remote code execution. It affects Supported Google Pixel devices, according to the currently cited disclosures. The practical risk depends on the vulnerable component, required access, available mitigations, and whether the device has received March 2026 Pixel Update Bulletin.

Is CVE-2026-0114 being exploited in the wild?

The status on this page is “Vendor confirmed.” A vendor-confirmed vulnerability is not necessarily known to be actively exploited. This database uses “Exploited in the wild” only when a cited vendor or authoritative security source reports observed exploitation; public PoC availability is tracked separately.

How do I protect a device from CVE-2026-0114?

Install the latest supported security update and verify the resulting build or patch level. The recorded minimum resolution is March 2026 Pixel Update Bulletin. Apply relevant compensating controls while updates are pending, but do not treat configuration changes as equivalent to patching the underlying vulnerability.