A simple video call can compromise millions of Android phones via a Unisoc modem flaw

A malicious video call might be all it takes to hack several popular Android devices. Researchers have demonstrated that many budget smartphones powered by Unisoc system-on-chip (SoC) devices are vulnerable to modem firmware exploits that grant attackers root access.

An independent security researcher using the alias 0x50594d hacked an Android smartphone by initiating a video call to the victim.

For the experiment, they breached a Realme C33 device and confirmed that the exploit worked on the Xiaomi Redmi A5 (security patch level 2026-01-01) and the Motorola E13 (security patch level 2025-02-01).

The flaw reportedly lies in the modem firmware reused across several Unisoc Technologies SoCs: T612, T616, T606, and T7250, which are widely used in entry-level phones.

“A critical vulnerability has been identified in the Unisoc modem firmware that allows arbitrary code execution with kernel privileges from the modem context,” reads a security advisory on SSD Secure Disclosure, a vulnerability acquisition and responsible disclosure program.

Unisoc is a major fabless chip designer based in Shanghai and the fourth-largest processor manufacturer after MediaTek, Qualcomm, and Apple, according to Counterpoint. The company specializes in mobile communications, IoT, and smart-device chipsets, powering many major brands such as Honor, realme, vivo, Samsung, and Motorola.

The company did not respond to disclosure attempts. The proof-of-concept code was fully released within the advisory.

The proof of concept was built entirely on researcher-controlled VoLTE (Voice over LTE) infrastructure, using rooted devices. However, the attacker's machine registered to the network in the same way as any standard user device would.

The exploit relies on sending custom, malformed VoLTE signaling messages that differ from those produced by ordinary calling apps. A real-world attack hasn’t been tested to confirm whether this would work on a real carrier network.

How does the exploit work?

The exploit targets the lack of isolation between modem memory and Android kernel memory when accessed from the modem’s execution context.

The vulnerability is described as an “exploitable Improper Isolation of Shared Resources on System-on-a-Chip,” which can lead to local privilege escalation, including the ability to modify kernel code.

An attacker who gains the ability to execute code on the modem can read from and write to the entire memory space by disabling protections on the first Memory Protection Unit (MPU) region (region ID 0),

explains the security advisory.

“An attacker who gains the ability to execute code on the modem can read from and write to the entire memory space by disabling protections on the first Memory Protection Unit (MPU) region (region ID 0),” the disclosure explains.

An attacker can use any smartphone to contact the victim – only the ability to place a video call is required. An additional machine is also required to run the exploit code.

To establish a call, the phone uses Session Initiation Protocol (SIP), a standard used by networks to manage phone calls.

Before calling, the attacker rigs several call setup messages (SIP INVITE) so that each carries malicious code embedded in message body fields normally used for call and media setup data.

Each message can carry a limited amount of data, so the payload is split across several INVITE messages, in 1200-byte chunks.

Then the attacker can initiate the call – if the victim answers the video call, the modem starts processing the leftover data and inadvertently runs the smuggled code.

It first runs the researcher’s initial payload, dubbed “egg hunter,” which then locates scattered fragments in the modem’s memory and reassembles the main payload's code, allowing the modem to read and write to the phone’s entire memory. The malware then essentially modifies the kernel.

The exploit is similar to another remote code execution vulnerability in the same firmware, disclosed earlier this year, that exploited a stack overflow condition to overwrite function pointers.

The disclosure was published on August 17th, 2026, with no CVE number assigned or patch status mentioned. Disclosure attempts were made via email and LinkedIn multiple times, but the researcher received no response.