# Unpatched Unisoc Chip Flaw Lets a Video Call Hijack Android's Kernel

Page: https://hirantha.me/blog/unpatched-unisoc-chip-flaw-lets-a-video-call-hijack-androids-kernel
Published: 2026-08-18
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: unisoc, android security, volte, kernel exploit, mobile vulnerability

> A disclosed but unfixed Unisoc modem flaw lets an attacker who already has a foothold take full control of an Android phone's kernel via one video call.

## What the flaw does

On budget Android phones built around certain Unisoc modems, answering a single video call can be the last step in a chain that hands an attacker full control of the phone's kernel, the core of the operating system. The flaw was published on 17 August 2026 by the independent research outlet SSD Secure Disclosure, credited to a researcher using the handle 0x50594d. No CVE (Common Vulnerabilities and Exposures) identifier has been assigned to it yet.

The root cause is architectural rather than a simple coding slip. On the affected chipsets, the modem, the chip responsible for cellular connectivity, and the application processor, which runs Android itself, share physical memory without a hardware-enforced boundary between them. Once an attacker can run code on the modem side, they can rewrite the settings of the chip's Memory Protection Unit, a hardware component meant to wall off memory regions from each other. Disabling the first protected region opens read, write and execute access across the entire 32-bit address space, which happens to include the physical address where the Android kernel itself lives. From there, the attacker can alter kernel code directly. Researchers classify this as CWE-1189, improper isolation of shared resources on a system-on-a-chip.

## Why this is stage two, not stage one

This privilege-escalation bug does not stand alone. It is the second half of a chain SSD began publishing in March 2026, when it disclosed a separate remote code execution flaw in the same modem firmware, triggered by a maliciously crafted SIP (Session Initiation Protocol) video call packet. That first flaw gets an attacker code execution on the modem. The newly published flaw is what lets that modem-level foothold escalate into full kernel access on the Android side. Individually, each half is serious; chained together, they add up to remote, kernel-level compromise of a phone that does nothing more than accept an incoming video call.

## Which phones are exposed

SSD confirmed the issue on the Unisoc T612 chipset, and The Hacker News reported the underlying isolation weakness also extends to the T606 and T7250 chipsets. Devices tested or cited include the Xiaomi Redmi A5, the Motorola E13 and the Realme C33, all entry-level phones. Unisoc chips ship widely in budget and mid-range handsets sold across more than 140 countries, which is what makes an unglamorous chipset bug worth paying attention to: it is not a niche part.

## The attack is real but not trivial to pull off

It is worth being precise about what it takes to actually exploit this. Completing the full chain requires an attacker who already controls a private 4G cellular network, has software-defined radio equipment, and can provision specialized SIM cards to get a target device to register onto that rogue network. That is a level of infrastructure available to intelligence services, well-funded criminal groups or specialist researchers, not to a random app developer or a scammer with a laptop. Once that network access exists, though, victim interaction is minimal: they just have to answer a video call. Neither SSD nor other outlets covering the disclosure have reported any evidence of this being used in real-world attacks so far, and no CVSS (Common Vulnerability Scoring System) severity score has been published for the new flaw.

## No patch, and a vendor that has gone quiet

This is the part of the story that should concern device owners more than the exploit mechanics. SSD says it tried to reach Unisoc through multiple channels, including email and LinkedIn, and received no response before publishing. Infosecurity Magazine reported it separately contacted Unisoc for comment and also got nothing back by the time it published. Neither the August 2026 Android Security Bulletin nor any Unisoc security bulletin currently addresses the flaw. The affected review devices carry security patch levels ranging from July 2025 to January 2026, meaning the phones were already behind on general Android patching even before this specific issue entered the picture.

## What this means in practice

If you own or manage a budget Android phone, the practical question is which modem it uses, and that is not something most people check. Unisoc does not put its name on the box the way Qualcomm or MediaTek sometimes do; it shows up in specification sheets as "Unisoc" or the model number of the chip itself (T606, T612, T7250). Device manufacturers, not Unisoc directly, are the ones who ship firmware updates to end users, so the immediate fix has to come from Motorola, Xiaomi, Realme and other brands that use these chips, once and if Unisoc supplies them a corrected baseband. Given the high bar to actually exploit this chain today, this is not a reason to panic about an ordinary phone call. It is, however, a reason for anyone responsible for fleets of budget Android devices, in a business, school or government setting, to ask their hardware vendor directly whether a fix is coming, rather than waiting for a bulletin that, five months after the first half of this chain was disclosed, still has not arrived.

## Questions

**What phones are affected by the Unisoc modem flaw?**
Confirmed or cited devices include the Xiaomi Redmi A5, Motorola E13 and Realme C33, built on Unisoc's T606, T612 and T7250 chipsets, which ship in budget and mid-range Android phones sold in more than 140 countries.

**Is there a patch available?**
No. As of publication, neither the August 2026 Android Security Bulletin nor Unisoc has issued a fix, and Unisoc has not responded to researcher or press outreach.

**How hard is this to actually exploit?**
Very hard for an average attacker. It requires already controlling a private 4G network with software-defined radio equipment and specialized SIM cards to pull a target device onto a rogue network, then getting the victim to answer a video call.

**Has this been exploited in the wild?**
No evidence of real-world exploitation has been reported by the researchers or outlets covering the disclosure.

**What should owners of budget Android phones do?**
Check with your device manufacturer, not Unisoc directly, about upcoming firmware updates, and keep installing whatever security patches your phone does receive since no dedicated fix for this flaw exists yet.

## Sources

- [Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access](https://thehackernews.com/2026/08/unisoc-volte-video-call-exploit-chain.html), The Hacker News
- [UNISOC T612 LPE](https://ssd-disclosure.com/unisoc-t612-lpe/), SSD Secure Disclosure
- [UNISOC Modem Flaw Enables Remote Code Execution via Video Calls](https://www.infosecurity-magazine.com/news/unisoc-modem-flaw-rce-calls/), Infosecurity Magazine