Researchers from SSD Secure Disclosure have published a two-stage attack chain that allows an attacker to obtain access to the Android kernel through the modem firmware of Unisoc chipsets.
The attack starts with a remote code execution vulnerability in the modem that was discovered in March 2026. A specially crafted VoLTE video call can execute arbitrary code on the modem. A subsequent privilege-escalation flaw then reconfigures memory protection and reaches the memory regions used by the Android kernel.
The root cause is the absence of hardware isolation between the modem and application processor in Unisoc system-on-chips. Because the two processors share the same physical memory, code already running in the modem context can modify memory protections and access kernel areas.
The researchers confirmed successful execution of their payload by observing messages in the system log. The vulnerable firmware is used in at least three chipset families: T606, T612 and T7250. These chips are found in devices including the Motorola E13, Realme C33 and Xiaomi Redmi A5.
Exploitation requires control of a private 4G network and VoLTE infrastructure; the victim must also answer the incoming video call. The scenario is therefore not considered mass-exploitable from the public mobile network.
No fix has been released by Unisoc, and no CVE identifier has been assigned. The August Android security bulletin does not address the problem. SSD Secure Disclosure stated that multiple contact attempts via email and LinkedIn received no response from the chip vendor.
