Security researchers from SSD Secure Disclosure have detailed a two-stage exploit chain that achieves full Android kernel access on devices using Unisoc modem firmware through a VoLTE video call. The advisory, published August 17, 2026, represents the second stage of a chain first disclosed in March 2026, which revealed remote code execution in the Unisoc modem firmware. The second stage escalates privileges to kernel level. Unisoc has not provided a fix as of publication.

Which products are affected?

Android Devices with Unisoc Modem

What should defenders do?

Until a patch is released by Unisoc, organizations should monitor for vendor advisories and apply any firmware updates when available. Users should ensure devices are running the latest Android security updates. Network-level mitigation is limited due to the VoLTE call vector. SSD Secure Disclosure has not released public exploitation material.

criticalZero-Day

Unisoc VoLTE Video Call Exploit Chain Achieves Full Android Kernel Access

Researchers disclose second stage of two-stage attack targeting Unisoc modem firmware; no patch available

CyberIntel DeskPublished about 1 month agoUpdated less than a minute ago1 min read

Unisoc VoLTE Video Call Exploit Chain Achieves Full Android Kernel Access

Key Takeaways

A two-stage exploit chain targeting Unisoc modem firmware achieves full Android kernel access via VoLTE video call.
The first stage, disclosed in March 2026, provided remote code execution; the second stage, disclosed August 17, 2026, escalates to kernel-level privileges.
Unisoc has not provided a patch or mitigation as of the advisory publication.

Related Security News

criticalZero-Day

Hackers exploit Citrix NetScaler zero-day to deploy web shells

Cybersecurity firms report that attackers are exploiting a zero-day vulnerability in Citrix NetScaler to deploy custom web shells and tunneling malware. The exploitation grants root access, enables credential theft, and facilitates lateral movement into internal networks. Citrix has released patches and security advisories addressing CVE-2026-88772.

BleepingComputerabout 6 hours ago1 min read