Unisoc VoLTE Exploit Chain Grants Android Kernel Access

Security researchers at SSD Secure Disclosure have detailed a two-stage exploit chain that allows attackers to gain full Android kernel access on devices utilizing Unisoc modem firmware. This vulnerability is exploitable through a Voice over LTE (VoLTE) video call, and as of August 17, 2026, the chipset maker Unisoc has not released a fix. The published advisory represents the second stage of a vulnerability chain that was initially disclosed in March 2026. In that first stage, SSD Secure Disclosure identified a remote code execution flaw within the Unisoc modem's handling of certain network protocols. This initial vulnerability, when chained with the newly disclosed second stage, creates a pathway for attackers to escalate privileges to the highest level on an Android device.

The exploit chain leverages specific weaknesses in how Unisoc's modem firmware processes data packets during a VoLTE video call. By sending specially crafted data, an attacker can trigger a buffer overflow or similar memory corruption vulnerability within the modem's software. This initial compromise allows for the execution of arbitrary code within the modem's context. The critical second stage then takes advantage of this foothold to pivot into the main Android operating system's kernel. Gaining kernel access means an attacker can bypass all standard Android security measures, including sandboxing and permission controls, effectively achieving complete control over the device. This level of access would permit the installation of persistent malware, data exfiltration, or even the complete bricking of the device.

Unisoc is a significant global supplier of mobile communications chipsets, powering a wide range of smartphones and other connected devices, particularly in the mid-range and budget segments. The widespread use of Unisoc modems means that this vulnerability could affect a substantial number of Android devices worldwide. The lack of an immediate patch from Unisoc raises concerns about the security posture of devices relying on their firmware. Security analysts emphasize that users of affected devices should remain vigilant and await official firmware updates from their device manufacturers, which would incorporate Unisoc's eventual fix. Without such updates, the risk of exploitation remains present for any device utilizing the vulnerable Unisoc modem firmware and capable of making VoLTE video calls.

The researchers have not publicly disclosed the exact technical details of the second-stage exploit to prevent immediate widespread abuse, but they have provided sufficient information in their advisory to alert Unisoc and device manufacturers to the severity and nature of the vulnerability. The disclosure follows responsible disclosure practices, giving the vendor time to develop and deploy a patch. However, the extended timeline for a fix, coupled with the critical nature of kernel-level access, highlights a persistent challenge in securing the complex supply chains of modern mobile devices. The vulnerability underscores the importance of rigorous security testing and auditing for all components within a device, including the modem firmware, which often operates with deep system privileges.