Google’s September Pixel Update Locks Some Phones Out

Some Pixel phones stopped accepting a correct PIN or pattern after the September 2026 update, and Google’s published path back in is a full wipe. The fault showed up on a Pixel 10 Pro XL, a Pixel 8a, and a Pixel 8 Pro. Google has not posted a public patch.

The same OTA that closed 110 Pixel-specific security flaws, including a modem bug CISA added to its exploited-vuln list, is the build owners blame. Support has messaged some people in public threads. The help article for a lockout still says to wipe the device.

Pattern Lines Die After Two Dots

The lock screen is finishing the attempt before the owner does. Android does not allow a one-dot pattern or a one-digit PIN, so each half-entered try is scored as a failure and feeds the lockout timer.

HOW THE UNLOCK FAILS

• Pattern reset: On a Pixel 10 Pro XL the line dies after one or two dots, so a long-used pattern never completes.
• PIN cutoff: On a Pixel 8a the phone treats the first digit as the whole code and returns a wrong-PIN error.
• Lockout clock: Those false failures trip “Too many attempts,” which parks the owner outside the phone for minutes at a time.

A Pixel 8 report described the pattern line cutting out mid-draw and still unlocking if the rest of the gesture was finished. That is the same early-commit behavior, just not all the way to a brick.

The reports sit in r/GooglePixel, including a Pixel 10 Pro XL thread that started after the September drop. They are scattered, not a fleet-wide outage, and they are ugly when they hit because the fallback lock is the thing that breaks.

A 110-Flaw Bulletin and a Must-Install Message

Google published the Pixel Update Bulletin on September 15, 2026, the same day Android 17 QPR1 began rolling out. Devices at the 2026-09-05 security patch level pick up that bulletin and the September Android Security Bulletin. The Pixel list alone runs to 110 flaws.

All supported Google devices will receive an update to the 2026-09-05 patch level. We encourage all customers to accept these updates to their devices.

Pixel Update Bulletin, Android Open Source Project, September 15, 2026

Among them is CVE-2026-58704, a High elevation-of-privilege bug in the cellular modem. The National Vulnerability Database describes a modem permission bypass with no user tap. CISA added that CVE to its Known Exploited Vulnerabilities catalog on September 16 and set a September 19 deadline for federal agencies, a three-day window.

THE SEPTEMBER PIXEL PATCH

• Rollout: September 15, 2026, as stable Android 17 QPR1 for supported Pixels.
• Patch level: 2026-09-05, the floor Google says covers this bulletin.
• Main build: CP3A.260905.009 for Pixel 6 through 10 family phones, including the 10a.
• Pixel 11 track: Earlier September images CD1A.260905.001.A1 and CD1A.260905.001.B1, before the QPR1 drop for older lines.

The public changelog is a bug-fix list, not a lock-screen rewrite. It includes a repair for notifications that were cut off on the lock screen, plus crashes, Bluetooth toggles, camera stability, game lag, and telephony drops. Owners who tapped Install were taking a security drop Google had just told them not to skip.

Which Pixel Phones Have Hit the Lockout

Three models have been named in the threads that Google support has also seen. A Pixel 6a on the same September drop still took a PIN as normal, which is why this reads as a subset, not a class failure.

MODELS NAMED IN UNLOCK REPORTS

Pixel 11 phones are not in those lockout threads. They were already on the earlier CD1A September images, then on their own QPR1 track. The named failures sit on the CP3A.260905.009 line that Pixel 6 through Pixel 10a received from September 15.

WHAT WE KNOW

• Trigger: Owners tie the fault to the September 2026 Pixel update, the QPR1 drop with patch 2026-09-05.
• Symptom: Pattern or PIN is judged before it is finished, then the lockout timer starts.
• Google: Support has contacted people in those threads and has not issued a public fix.

WHAT IS UNCONFIRMED

• Root cause: No engineering note names the lock-screen code that commits early.
• Full list: Other Pixel models may be affected; they have not been documented the same way.
• Next OTA: No date is on a patch that restores PIN and pattern entry.

Biometrics are not the method in the write-ups. The people stuck are the ones whose backup lock is a pattern or a PIN, which is also the lock Android demands after a reboot, an app install, or a settings change.

Safe Mode and a USB Mouse Did Not Help

The Pixel 10 Pro XL owner who kicked off the main thread ran the usual hardware checks first. Safe mode, a restart, a clean screen, and a USB mouse through an adapter all failed at the same point in the pattern. A mouse still dying on the second dot is a software commit, not a dead digitizer.

Sideloading the same September build did not clear it either. After a wipe, the old pattern still failed when another Pixel asked for it during a data transfer, so the owner moved to a PIN. That swap is a weak comfort, because the Pixel 8a case is a PIN that submits after one digit.

One Pixel 10 Pro XL owner got back in with a hard restart, power and volume down held together. A Pixel 8a owner sat through the lockout timer instead of wiping. Those two paths keep local photos. They are not what Google’s lockout article tells you to do, and they did not work for everyone who posted.

At least one Pixel 10 owner described a correct PIN coming back as wrong, then a wipe that took local files with it. That is the cost when the non-destructive tricks miss: the phone you patched to stay safe is the phone you cannot open.

The Help Page’s Answer Is a Factory Reset

Pixel Phone Help has a page for this exact bind. It does not offer a PIN override, a Google Account unlock on the lock screen, or a remote credential reset. It tells you to wipe.

If you can’t unlock your phone, you’ll need to erase it. Then you can set it up again and set a new screen lock.

Pixel Phone Help, Google

The same article says those options erase the phone and set a new lock, and that apps, photos, and music on the device go with it. Backups in a Google Account can come back if you knew the PIN or pattern at the time of backup. Anything that never left the phone does not.

That is the designed trade. A lock screen that will not yield is doing the job it was given, even when the failure is Google’s software scoring a half-drawn pattern as a wrong try. A Google support account answered a locked-out Pixel 10 owner on September 28 with a link to that erase article. The public bug still has no advisory of its own.

Google’s own factory-reset primer warns that a wipe can take up to an hour and asks you to charge to at least 70% and stay on Wi-Fi or mobile data so you can sign back into the Google Account. Those steps assume you can open Settings. On a phone that will not take the PIN, you cannot.

How a Locked Pixel Gets Wiped From Fastboot

The button path is the one left when Settings is behind the broken lock. Google’s Fastboot instructions for Pixel 6 and later are volume down and power held together for up to 30 seconds. Hold too long and the phone reboots, so you start again.

THE FASTBOOT WIPE PATH

1. Fastboot: Power off, then hold volume down and power until Fastboot mode appears.
2. Recovery: Highlight Recovery Mode with the volume keys and press power.
3. No command: Hold power, tap volume up, then release both to reach Android Recovery.
4. Wipe: Choose Wipe data/factory reset, then Factory data reset, then Reboot system now.

After the wipe you hit setup, Factory Reset Protection, and a new screen lock. If a Google backup is current, a lot of the account-side data returns. Local files that were never backed up are gone, which is why people tried Safe Mode and a mouse first.

Google also publishes OTA packages and factory images for anyone who wants to sideload instead of waiting for the next wave. Sideloading the same September build already failed for at least one locked-out owner, so that route is a reinstall of the broken drop unless a newer image exists.

eSIM, Battery Drain, and a Wi-Fi Hangover

The lock screen is a new failure mode on a year that already had Pixel software in the complaint pile. None of those earlier bugs locked the owner out of the device itself. This one does.

PIXEL SOFTWARE TROUBLE IN 2026

1. May 2026: Owners report eSIM drops, missing profiles, and restarts to restore a line, with Google acknowledging the mess and pointing at sideloaded firmware in some cases.
2. July 2026: Fast battery drain hits a run of Pixels. Google said a late July update fixed it. Complaints continued after that note.
3. August 28, 2026: Android 17 QPR2 Beta 4 still lists crash, charge-limit, launcher search, and System UI bugs while QPR1 is about to go stable.
4. Early September 2026: Pixel 11 owners report Wi-Fi that will not stay up, then idle drain tied to some routers waking the radio about 135 times a minute.
5. September 15, 2026: Android 17 QPR1 and patch 2026-09-05 begin rolling out with the 110-flaw Pixel bulletin.
6. September 16, 2026: CISA lists CVE-2026-58704 as known exploited, due September 19 for federal agencies.
7. September 22-25, 2026: Pattern and PIN lockout posts land; Google support starts messaging those threads.
8. September 28, 2026: A Google support account points a locked-out Pixel 10 owner at the erase-the-phone help page.

QPR1 also shipped Pixel Drop extras, VIP widgets, wider scam detection, Pause Point on older phones. Those are the items the drop was sold on. The lock screen is not in the “what’s new” list. It is in the wreckage after Install.

Google support has seen the threads and still has not posted a public workaround short of a wipe. Until a later build changes how the lock screen commits a pattern or a PIN, the people already inside that bug are choosing between a timer, a hard restart that might not last, and the erase path Google documents for a phone you cannot unlock.