A malicious video call may be enough to hack several popular Android devices. A researcher demonstrated that a number of budget smartphones powered by Unisoc systems-on-chip (SoCs) are vulnerable to modem firmware exploits that could give attackers root access.
An independent security researcher who goes by the alias 0x50594d demonstrated how an Android smartphone could be hacked through a video call to the victim.
During the experiment, the researcher successfully compromised a Realme C33 and also confirmed that the exploit worked on a Xiaomi Redmi A5 with the January 1, 2026 security patch and a Motorola E13 with the February 1, 2025 security patch.
The vulnerability reportedly resides in modem firmware used across several Unisoc Technologies systems-on-chip: the T612, T616, T606, and T7250. These chips are widely used in entry-level smartphones.
“A critical vulnerability has been identified in the Unisoc modem firmware that allows arbitrary code execution with kernel privileges from the modem context,” according to an advisory from SSD Secure Disclosure, a vulnerability research and responsible disclosure program.
Unisoc is a major Chinese fabless chip designer headquartered in Shanghai and the fourth-largest smartphone processor vendor after MediaTek, Qualcomm, and Apple, according to Counterpoint. The company specializes in mobile communications, Internet of Things (IoT) solutions, and chipsets for smart devices. Its technology is used in devices from numerous major brands, including Honor, realme, vivo, Samsung, and Motorola.
Unisoc did not respond to the researcher’s attempts to report the vulnerability. As a result, the full proof-of-concept (PoC) code demonstrating how the flaw can be exploited was published alongside the vulnerability disclosure.
The proof of concept was developed and tested entirely within a VoLTE (Voice over LTE) infrastructure controlled by the researcher, using rooted devices. However, the attacker’s device registered on the network in the same way as a standard consumer smartphone.
The exploit relies on sending specially crafted, malformed VoLTE signaling messages that differ from those generated by ordinary calling applications. The attack has not been tested on a real mobile carrier network, so it remains unconfirmed whether the exploit would work under real-world network conditions.
The exploit takes advantage of insufficient isolation between modem memory and Android kernel memory when accessed from the modem execution context.
The vulnerability is described as “improper isolation of shared resources on a system-on-chip.” Exploiting it could lead to local privilege escalation, including the ability to modify operating system kernel code.
“An attacker who gains the ability to execute code on the modem can read and write data across the entire memory space by disabling protection for the first Memory Protection Unit (MPU) region, identified as region 0,” the vulnerability disclosure explains.
To contact the victim, an attacker can use a regular smartphone. The main requirement is the ability to make video calls. An additional device is also required to run the exploit code.
To establish a call, the smartphone uses the Session Initiation Protocol (SIP), a standard protocol used by networks to manage phone calls.
Before making the call, the attacker modifies several call setup messages (SIP INVITE) so that each contains malicious code. The code is embedded in message body fields normally used to transmit information required to set up the call and media connection.
Because each message can carry only a limited amount of data, the payload is split across multiple INVITE messages into chunks of approximately 1,200 bytes.
The attacker then initiates the call. If the victim answers the video call, the modem begins processing the received data and inadvertently executes the code hidden within it.
The first component to run is an initial payload the researcher calls an “egg hunter.” It locates the scattered fragments in the modem’s memory and reassembles them into the main payload. As a result, the modem gains the ability to read and write across the smartphone’s entire memory space, after which the exploit can effectively modify the system kernel.
The exploit is similar to another remote code execution vulnerability in the same firmware that was disclosed earlier this year. That flaw exploited a stack overflow to overwrite function pointers.
Details of the new vulnerability were published on August 17, 2026. At the time of disclosure, no CVE identifier had been assigned, and no information about an available patch had been provided.
The researcher repeatedly attempted to notify Unisoc about the vulnerability via email and LinkedIn but received no response.
