A few days ago, researchers from Secure Disclosure revealed a critical flaw in the design of Unisoc SoCs, which allows an attacker to take complete control of the system through a simple video call.
This vulnerability reveals a two-stage exploit chain that culminates in kernel-level code execution. Most alarming is that the semiconductor manufacturer, whose chips power devices from brands like Motorola, Realme, and Xiaomi in over 140 countries, has not released any patch or official response, leaving millions of devices exposed to local privilege escalation attacks without user interaction.
Analysis of the exploitation chain
The assault begins from the outside by taking control of a private 4G cellular network . To build the test environment, the researchers used an open-source core network based on Open5GS and Kamailio, interconnected via software-defined radio (LimeSDR) and specialized SIM cards.
From this infrastructure, the attacker initiates a video call using a Remote Code Execution (RCE) vulnerability in the modem's firmware , discovered in March 2026. The attacker sends malformed SIP packets. When the victim answers the call, the first component of the attack infects the device's modem, establishing the necessary framework to launch the second and more devastating phase of the intrusion.
Vulnerability (CWE-1189)
The real security issue lies in a flaw classified as CWE-1189, which describes inadequate isolation of shared resources . In Unisoc chips, the modem processor and the application processor (where Android runs) share the same physical memory space.
Because there is no strict hardware isolation, malicious code executed on the modem can alter the coprocessor registers of the ARM architecture. Using specific assembly language instructions, the attacker disables the protections of the first region (ID 0) of the Memory Protection Unit (MPU). This reconfiguration maps the entire 32-bit physical address space as readable, writable, and executable, directly exposing the physical address where the Android kernel resides.
However, injecting the final code is not a simple task due to the limitations of the network protocol. The SIP message used as an attack vector fragments the payload into memory blocks scattered across the modem's heap, separated by empty spaces. To overcome this, the attackers implemented a sophisticated "Egg Hunter" mechanism written in assembly language.
This small program methodically scans the modem's memory for a specific hexadecimal signature that marks the beginning of each malicious fragment. Once located, the "Egg Hunter" extracts and reassembles the blocks contiguously at a specific memory address, paving the way for kernel overwriting.
With the payload fully reassembled and the MPU protections disabled, the exploit proceeds to inject the malicious code, or shellcode, directly into the operating system's memory. The injection is divided into two strategic sections: the first overwrites a system compatibility function, while the second installs a "jump ramp" or execution jump in the system's vital file opening function.
To prevent device crashes from multiple executions, the code incorporates a mutex, or mutual exclusion lock, in the uninitialized memory section. When the Android kernel attempts to operate normally, the springboard redirects the execution flow to the injected shellcode, confirming full access by logging the exploit's success directly to the kernel registers.
This level of access is not an isolated incident in Unisoc's history, as in November 2025, Kaspersky researchers documented an identical condition in processors used in vehicle infotainment systems , and in 2022 Check Point Research reported similar vulnerabilities.
Although testing teams confirmed the effectiveness of this new exploit chain on recent models such as the Motorola E13, the Realme C33, and the Xiaomi Redmi A5 with security patches updated until 2026, the lack of response from the manufacturer and the absence of solutions in Android bulletins do not paint a good picture for users.
Until a modem firmware update is deployed that strengthens Memory Protection Unit policies, the mobile infrastructure of millions of users will remain vulnerable to attackers with the ability to simulate cellular networks.
If you are interested in learning more, you can find the details at the following link.