Security researchers at SSD Secure Disclosure have published the second stage of a two-part exploit chain that can hand an attacker complete control over the Android kernel on phones built around Unisoc modem chipsets — and no patch exists for either stage.
The attack begins with an initial remote code execution flaw in Unisoc modem firmware, disclosed by the same team in March 2026, which can be triggered by sending a malformed SIP video call to the target. The new August 2026 research completes the chain: once the attacker has code running on the modem, they can use a privilege-escalation technique to reach the phone’s Android kernel. The method exploits a fundamental architectural design of Unisoc system-on-chip processors: the modem processor and the application processor (which runs Android) share the same physical memory space without any hardware-enforced boundary between them. By writing a full-access configuration to the modem’s ARM Memory Protection Unit, the attacker maps the entire physical address space — including where the Android kernel lives — as readable, writable, and executable from modem context. The result is full kernel-level code execution on the Android side. Researchers verified this on a live test device by observing kernel log output from injected code.
Executing the complete chain requires the attacker to control a private 4G cellular network capable of delivering VoLTE video calls, and requires the victim to answer an incoming video call. This is not a drive-by attack that works over the public internet, but it is well within the reach of a sophisticated threat actor — rogue base stations and interception equipment are used by law enforcement agencies and state-sponsored actors worldwide. The August 2026 Android Security Bulletin, published just before this disclosure, does not address the privilege-escalation vulnerability, and Unisoc has not issued a chipset-level security bulletin covering either flaw.
How to check if you’re affected
Affected models include any Android device powered by a Unisoc T606, T612, or T7250 chipset. Specifically confirmed affected models are the Motorola E13, Realme C33, and Xiaomi Redmi A5, though other handsets from the same chipset families sold in over 140 countries may also be affected. Unisoc supplies components to Motorola, Realme, Xiaomi, and other manufacturers for budget and mid-range Android devices. Researchers confirmed the flaw on devices carrying security patches as recent as January 2026, meaning up-to-date patches do not protect against this. No firmware update or mitigation is currently available — watch for over-the-air updates from your device manufacturer, and apply them as soon as they are released.