On August 17, 2026, researchers at SSD Secure Disclosure published the second half of an exploit chain that turns a single VoLTE video call into full Android kernel access on phones built around Unisoc modem firmware — and there is no patch, because the chipset maker never responded. It is one of the more alarming mobile disclosures of the year, but it is also widely misunderstood. Here is what the chain actually does, who is genuinely at risk, and what to do about it — with the hype stripped out.
What was disclosed
The attack is a two-stage chain:
- Stage one (March 2026): SSD disclosed remote code execution inside the Unisoc modem firmware itself, triggered by a malformed SIP video call — the signalling that sets up a VoLTE (Voice/Video over LTE) session.
- Stage two (August 17, 2026): the new half pivots from that foothold in the modem up into the Android kernel, escalating from code execution on the baseband to full kernel privileges on the application processor.
Chained together, an attacker who can place a VoLTE video call to a vulnerable device can go from “no access” to “owns the operating system” — below the level where antivirus, app sandboxes, or most EDR can see anything.
The part everyone gets wrong: this is not “answer a call from anywhere and you’re owned”
The scary one-liner — “a video call takes over your phone” — is technically true and practically misleading. Read SSD’s own conditions carefully. Completing the full chain requires two things the attacker must arrange:
- Control of a private 4G cellular network. The attacker needs the victim’s phone connected to a cellular network they control — a rogue base station, a femtocell, or an IMSI-catcher-style setup. This is proximity-based and targeted, not something sprayed across the internet.
- The victim answers the incoming video call. The chain is not fully zero-click; it needs the call to be accepted.
That threat model matters enormously. This is not ransomware-grade mass exploitation. It is a targeted-surveillance capability: the kind of thing that is realistic at a border crossing, in a hostile venue, against a journalist or activist connected to an attacker-run network — not a random person on their carrier’s normal 4G. Calibrating this correctly is the difference between useful caution and pointless panic.
Why the modem is such a dangerous place for a bug
The baseband processor that runs modem firmware is one of the most under-appreciated attack surfaces in every phone. It runs its own real-time operating system, beneath Android, on proprietary code that is rarely open to outside review. It parses hostile input from the cellular network by design — every SMS, every call-setup message, every SIP packet — which makes it a parser’s worst nightmare: complex, legacy, and permanently exposed. When a bug there can reach up into the main kernel, as this chain does, the usual Android security model — verified boot, SELinux, app sandboxing — is largely bypassed, because the attacker is already executing below it.
Who is actually affected
Unisoc (formerly Spreadtrum) is not a household name in the West, but it is one of the largest suppliers of budget smartphone, tablet, and IoT chipsets in the world, with especially heavy market share in entry-level devices across India, Southeast Asia, Africa, and Latin America. If you own a flagship Samsung, Pixel, or iPhone, this specific chain does not apply to you. If you — or the population you are responsible for — use low-cost Android phones in emerging markets, Unisoc silicon is very likely in the mix, and this is exactly the segment least likely to receive timely firmware updates.
The real story: nobody is coming to fix it
The most damning detail is not the exploit — it is the silence. SSD states it tried to reach Unisoc “through multiple channels (email and LinkedIn) but have not been able to receive any response.” As of publication, the August 2026 Android Security Bulletin does not address the privilege escalation, and no Unisoc security bulletin covers it either. There is no patch, no timeline, and no acknowledgement.
This is the structural weakness of budget mobile security laid bare. Android’s monthly patch model assumes the chip vendor participates. When the vendor is unresponsive and the affected devices are cheap, out-of-support handsets in markets with little regulatory pressure, the patch pipeline simply has no source. The vulnerability doesn’t get fixed; it gets inherited by every future device on the same firmware.
What to actually do
If you are a high-risk user (journalist, activist, executive travelling to hostile regions) on a Unisoc-based device:
- Treat VoLTE/Wi-Fi calling as an attack surface. Where your device allows it, disabling VoLTE removes the specific call-setup path this chain abuses (at the cost of call quality/features).
- Do not answer video calls from unknown parties, especially on untrusted or unfamiliar networks — the chain needs the call answered.
- For genuinely sensitive contexts, carry a phone built on a chipset with an active, responsive security program. This is a case where hardware choice is a security control.
If you run a fleet or protect a population:
- Inventory your devices by chipset, not just by brand. MDM/EMM platforms can surface hardware details — identify Unisoc-based handsets and treat them as elevated risk until firmware is confirmed patched (which, here, it is not).
- Apply policy accordingly: restrict what sensitive data or access those devices hold, and prefer supported hardware for staff in high-risk regions.
- Watch for the stage-one fix. If Unisoc ever ships modem firmware addressing the March RCE, that breaks the chain at its root — but do not wait on it.
For researchers: baseband is still wide open
The lasting takeaway for the offensive-security community is that modem and baseband firmware remains one of the richest, least-explored attack surfaces in mobile. SIP and VoLTE call-setup parsing, the RTP media paths, and the shared-memory boundary between the modem and the application processor are all complex, hostile-input-facing, and thinly audited. This chain is a reminder that the most impactful mobile bugs increasingly live below the OS — and that a modem-to-kernel pivot turns a “just the baseband” bug into total device compromise.
The bottom line
A VoLTE video call really can hand an attacker the Android kernel on Unisoc-based phones, and there is no fix. But the realistic risk is targeted, proximity-based surveillance — not mass exploitation — and it concentrates on budget Android devices in exactly the markets least equipped to respond. If you’re high-risk on affected hardware, disable VoLTE and don’t answer video calls on untrusted networks. If you manage devices, inventory by chipset and treat Unisoc handsets as unpatched, because they are. The exploit is impressive; the vendor silence is the actual crisis.
Sources: Kortex Consulting — Unisoc VoLTE Exploit Chain · SSD Secure Disclosure advisory (August 17, 2026) · The Hacker News. Verify device-specific exposure against your handset’s chipset and your carrier before acting.