Security researchers have disclosed a complete exploit chain that allows attackers to gain full control of the Android kernel on phones powered by Unisoc modem chips through a VoLTE video call, with the chipset manufacturer failing to respond or issue a fix. SSD Secure Disclosure published the advisory on August 17, 2026, revealing the second stage of an attack path that began with a March 2026 disclosure of remote code execution in the same firmware. The complete attack requires the attacker to operate a private 4G cellular network and the victim to accept an incoming video call.
The privilege-escalation vulnerability affects modem firmware shared across at least three Unisoc chipsets: the T606 found in the Motorola E13, the T612 in the Realme C33, and the T7250 in the Xiaomi Redmi A5. Researchers confirmed the flaw on a Motorola E13 running a February 2025 security patch and on a Xiaomi Redmi A5 with a January 2026 patch. The vulnerability is classified as CWE-1189, Improper Isolation of Shared Resources on System-on-a-Chip, and has not been assigned a CVE identifier. Unisoc, a Shanghai-based chipmaker formerly called Spreadtrum, provides components to manufacturers including Motorola, Realme, and Xiaomi for devices distributed in more than 140 countries. The August 2026 Android Security Bulletin, released before this disclosure, does not address the privilege-escalation flaw, and no Unisoc security bulletin covers it.
The research was conducted by an independent security researcher known as 0x50594d, who documented multiple failed attempts to reach the vendor. "We have tried to reach out to the vendor through multiple channels (email and LinkedIn) but have not been able to receive any response," SSD Secure Disclosure stated in its advisory, echoing the same message from the March 2026 disclosure. The exploit works by writing a full-access configuration to the modem's ARM Memory Protection Unit through coprocessor registers, mapping the entire 32-bit physical address space as readable, writable, and executable from modem context, including the pages where the Android kernel resides. Researchers confirmed kernel-level code execution on a test device by observing kernel log output showing that the injected payload had run.
The vulnerability exists because of a shared physical memory space between the modem processor and the application processor within the Unisoc system-on-a-chip, with no hardware-enforced boundary preventing modem-context code from modifying kernel memory. The researchers built their proof-of-concept environment using an open-source 4G core network, a software-defined radio for the 4G radio interface, and specialized SIM cards. Independent research published by Kaspersky ICS CERT in November 2025 documented the same architectural condition on a different Unisoc chip, the UIS7862A, found in vehicle head units, and described one lateral movement path involving a hidden Direct Memory Access peripheral as a hardware-level issue not fixable through a software update. The Memory Protection Unit route used in the SSD chain is in principle addressable through a firmware change, though Unisoc has not committed to such an update.
Device owners currently have no available patch or mitigation and should monitor for firmware updates from their device manufacturers. A coordinated Unisoc modem vulnerability discovered by Check Point Research in 2022, CVE-2022-20210, was patched by Unisoc and distributed through the Android Security Bulletin, but the two currently disclosed vulnerabilities carry no such assurance. Absent vendor engagement, the disclosure effectively transfers risk from the researcher's private knowledge to public awareness, with the burden of response now falling entirely on downstream manufacturers and their customers. Whether device makers can or will ship updates for budget handsets already in the field remains the central question for millions of users across more than 140 markets.