A malicious video call is all it takes to hand attackers full kernel access on some of the cheapest Android phones sold today — and the chipmaker hasn't answered a single email in five months.
Answering a video call has just become a genuine attack vector on some of the cheapest Android phones you can buy. Researchers have chained two flaws in Unisoc modem firmware — one disclosed in March, one new this month — into a full path from a single VoLTE video call to complete Android kernel access. There's no CVE for the newer half of the chain, no patch for either half, and the chipmaker hasn't responded to a single outreach attempt in five months.
The attack, step by step
The chain needs two things a lot of attack chains don't: access to cellular infrastructure the target's phone will actually connect to, and one answered call. It's not a drive-by web exploit — but it doesn't need malware installed on the phone, a malicious app, or a single tap from the victim beyond picking up.
Attacker positions attacker-controlled 4G/VoLTE infrastructure the target device will connect to
2
A malformed SIP/SDP message corrupts memory in the modem's call-setup handling, running attacker code inside the modem itself
3
Attacker places a VoLTE video call to the target device
4
Victim answers — the second flaw abuses unisolated modem/kernel memory to escalate from modem-level code execution to full Android kernel privileges
Why this one is different
Most mobile RCE chains get a CVE, a severity score, and eventually a firmware patch pushed through the Android Security Bulletin. This one doesn't have the second half of that story yet. The privilege-escalation flaw is filed under CWE-1189 — Improper Isolation of Shared Resources on a System-on-a-Chip — which describes an architectural decision, not a fixable line of code. Unisoc's modem and application processor share physical memory without a hardware-enforced boundary between them, and August's Android Security Bulletin doesn't touch it.
The exploit chain requires the victim to answer one VoLTE video call — no app install, no link click, no malware needed on the device beforehand. · Unsplash
What you can actually do about it
Check Settings > About Phone, or search your exact model, for T606, T612, or T7250 branding — SSD's advisory only confirms these three chipsets so far, but the shared modem firmware likely touches more Unisoc SoCs.
Treat unknown-number video calls the way you'd treat an unknown attachment: let it go to voicemail instead of answering.
Watch for a firmware update from your phone's manufacturer, not from Unisoc directly — OEMs like Motorola, Realme, and Xiaomi control the actual OTA push.
If it's a work device, flag it to IT now. There's no patch to apply yet, only exposure to track.
No — CWE-1189 covers the privilege-escalation half, but neither Unisoc flaw has a CVE assigned yet. A missing CVE ID doesn't mean missing risk; it usually just means the vendor hasn't formally acknowledged it.
Is this only a problem for the three phones named?
Those are the three SSD has confirmed testing against. The underlying modem firmware is shared across more Unisoc chipsets, so treat any budget Android phone with a Unisoc SoC as potentially exposed until proven otherwise.
Can I just turn off VoLTE to be safe?
That removes the video-call vector, but VoLTE is required for voice and video calls on most carriers now that 3G is being retired, so it's a stopgap at best, not a realistic fix for most people.
Has this been exploited in the wild yet?
There's no public evidence of in-the-wild exploitation as of this writing. The concern is that a fully documented, unpatched kernel-takeover chain now exists with no vendor response in sight.
My honest take: this is a supply-chain neglect story wearing a security-bug costume. The exploit is real and worth taking seriously, but the actual scandal is a chipmaker sitting on two disclosed flaws — one for five months — without so much as an acknowledgment, on silicon that powers some of the most-sold phones on earth. Watch for whether Unisoc responds at all before you watch for a patch.
