SSD Publishes 2-Stage Unisoc VoLTE Exploit for Full Android Kernel Access
Updated
Updated · The Hacker News · Aug 17
SSD Publishes 2-Stage Unisoc VoLTE Exploit for Full Android Kernel Access
3 articles · Updated · The Hacker News · Aug 17
Summary
SSD Secure Disclosure said its newly published second-stage flaw lets attackers pivot from Unisoc modem code execution to full Android kernel access on affected phones, with no vendor patch or CVE assigned.
The chain builds on a March 2026 remote-code-execution bug in the same modem firmware and requires a private 4G network plus a victim who answers a VoLTE video call.
Researchers verified the privilege-escalation step on a Motorola E13 with a February 2025 patch and a Xiaomi Redmi A5 with a January 2026 patch, showing existing updates do not block it.
The flaw stems from shared physical memory between the modem and application processor, allowing modem-context code to rewrite memory protections and access kernel pages directly.
Unisoc, whose chips ship in devices sold in more than 140 countries, did not respond to SSD; the disclosure echoes earlier research showing the same architectural weakness on other Unisoc platforms.
Why do modern budget processors still share memory between modems and kernels, leaving massive blind spots for attackers?
Could answering a simple video call on your budget smartphone hand hackers the keys to your entire operating system?
Global Android Security Crisis: Unisoc VoLTE Exploit Threatens 14% of Devices with Undetectable Kernel Compromise
Overview
In August 2026, researchers revealed a critical two-stage exploit chain affecting millions of Unisoc-powered Android devices. The attack starts when a victim answers a malicious VoLTE video call, triggering a flaw in the modem firmware that lets an attacker gain remote code execution on the modem. Due to a lack of hardware isolation in Unisoc’s system-on-chip design, the attacker can then disable memory protections and take full control of the Android kernel, enabling covert surveillance and persistent device compromise. With no official patch available, users are urged to manually disable VoLTE video calling features to protect themselves.