In modem

CVE-2026-0120 is an out-of-bounds write in the Android modem/baseband path that can plausibly yield remote code execution during modem traffic handling. Google disclosed it on 2026-03-10, and Android/Pixel bulletins say devices at security patch level 2026-03-05 or later address the March 2026 issues. In practice, the affected population is best described as Android devices still below the March 2026 patch level, with Google Pixel specifically calling out this CVE in its March 2026 device bulletin.

The vendor's 9.8 CRITICAL score reflects the *technical* worst case: no auth, no clicks, potential code exec in a network-reachable component. Reality is harsher on attackers. This is not a clean internet-service RCE on port 443; it is a modem-path bug that likely requires radio-path reachability, specialized exploit development, and often an additional pivot out of the baseband to create the kind of enterprise impact security teams care about. That keeps it urgent, but not top-shelf emergency-for-everyone critical.

Why this verdict

• Downgrade for attacker position: vendor 9.8 starts from a worst-case AV:N view, but here network means the modem/radio path, not a universally reachable enterprise internet service.
• Downgrade for exposed population: only Android devices missing the March 2026 patch level are in scope, and many enterprise estates have limited Android/Pixel density compared with server and desktop fleets.
• Downgrade for exploit friction: no verified public PoC or exploitation evidence was found, and baseband exploit engineering is harder than typical edge-RCE weaponization.
• Downgrade for blast-radius conversion: baseband compromise is dangerous, but the worst business impact often requires a second pivot into the application processor, enterprise apps, or identity material.
• Keep it HIGH, not MEDIUM: unauthenticated no-click modem RCE remains a serious class of bug, and managed mobile fleets still carry sensitive identities, MFA factors, email, and corp data.

Why not higher?

I do not buy CRITICAL for fleet prioritization because this is not a mass-reachable, internet-exposed service flaw with commodity exploit preconditions. The combination of radio-path reachability, specialized exploit development, and likely need for follow-on chaining cuts the practical enterprise emergency level below the vendor headline score.

Why not lower?

This is still a remote, no-user-interaction memory corruption issue in a high-value component. If you run a sizable Android fleet, especially for executives, travelers, journalists, or high-risk personnel, the surveillance and device-compromise potential is too meaningful to treat as routine backlog.

1. Enforce Android patch compliance — Use UEM/MDM conditional access to block or restrict Android devices below security patch level 2026-03-05. For a HIGH verdict, deploy this within 30 days; it is the cleanest compensating control because the bulletin maps directly to a patch-level check.
2. Restrict high-risk users to patched devices — Move executives, admins, legal, threat intel, and frequent travelers onto confirmed-patched handsets first. Do this within 30 days because these users have the highest value if a radio-path attack is used for surveillance or credential access.
3. Reduce trust in mobile posture — Require device-compliance signals for email, SSO, VPN, and SaaS access from Android. Deploy within 30 days so a compromised handset has less downstream value even if the modem bug is exploited.
4. Prefer managed Wi-Fi where feasible — For especially sensitive users or temporary risk reduction, minimize unnecessary cellular exposure when business operations allow, and disable unused SIM/eSIM profiles. This is not a full fix, but as a HIGH compensating step it is useful when patch uptake lags inside the 30-day window.

Run this on an auditor workstation with adb installed and at least one Android device connected over USB or approved wireless ADB. Invoke it as python3 check_cve_2026_0120.py --serial <device_serial> or omit --serial for the first attached device; no root is required, but you need ADB access to the handset.

#!/usr/bin/env python3
# check_cve_2026_0120.py
# Verify likely exposure to CVE-2026-0120 by checking Android security patch level.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR

import argparse
import datetime
import shutil
import subprocess
import sys

PATCH_DATE = datetime.date(2026, 3, 5)


def run(cmd):
    return subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)


def adb_shell(serial, prop):
    base = ["adb"]
    if serial:
        base += ["-s", serial]
    base += ["shell", "getprop", prop]
    r = run(base)
    if r.returncode != 0:
        raise RuntimeError(r.stderr.strip() or f"adb failed for {prop}")
    return r.stdout.strip()


def parse_date(s):
    try:
        parts = s.strip().split("-")
        if len(parts) != 3:
            return None
        y, m, d = map(int, parts)
        return datetime.date(y, m, d)
    except Exception:
        return None


def main():
    ap = argparse.ArgumentParser(description="Check likely exposure to CVE-2026-0120 via Android security patch level")
    ap.add_argument("--serial", help="ADB device serial", default=None)
    args = ap.parse_args()

    if shutil.which("adb") is None:
        print("UNKNOWN - adb not found in PATH")
        sys.exit(2)

    try:
        patch = adb_shell(args.serial, "ro.build.version.security_patch")
        brand = adb_shell(args.serial, "ro.product.brand")
        model = adb_shell(args.serial, "ro.product.model")
        build = adb_shell(args.serial, "ro.build.display.id")
    except Exception as e:
        print(f"UNKNOWN - unable to query device: {e}")
        sys.exit(2)

    if not patch:
        print(f"UNKNOWN - device {brand} {model} did not report a security patch level")
        sys.exit(2)

    patch_date = parse_date(patch)
    if patch_date is None:
        print(f"UNKNOWN - unparseable security patch level '{patch}' on {brand} {model} ({build})")
        sys.exit(2)

    # Operational rule from Android/Pixel March 2026 bulletins:
    # security patch level 2026-03-05 or later addresses the March 2026 issues.
    if patch_date >= PATCH_DATE:
        print(f"PATCHED - {brand} {model} reports security patch level {patch} (build: {build})")
        sys.exit(0)
    else:
        print(f"VULNERABLE - {brand} {model} reports security patch level {patch}, below 2026-03-05 (build: {build})")
        sys.exit(1)


if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        print("UNKNOWN - interrupted")
        sys.exit(2)

Sources

1. Android Security Bulletin—March 2026
2. Pixel Update Bulletin—March 2026
3. NVD entry for CVE-2026-0120
4. OpenCVE rendered record for CVE-2026-0120
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. FIRST EPSS data documentation
8. Android Help: Check & update your Android version