Executive Summary
Security researchers have disclosed a critical two-stage exploit chain targeting Unisoc modem firmware used in numerous Android devices, including models from Motorola, Realme, and Xiaomi. The attack begins with a remote code execution (RCE) via a malformed SIP video call, followed by a local privilege escalation (LPE) that grants the attacker full access to the Android kernel. The vulnerability stems from a lack of hardware-enforced boundaries between the modem and application processors, allowing the modem to modify shared physical memory.
The attack requires the victim to answer an incoming video call and necessitates the attacker controlling a private 4G cellular network or using a software-defined radio. Despite disclosure in March and August 2026, the vendor has not provided a fix, and the vulnerability remains unaddressed in official security bulletins as of the report date.
This architectural flaw represents a significant risk as it bypasses standard Android security controls at the hardware level. The impact extends beyond mobile devices, with similar shared memory conditions previously identified in Unisoc-based vehicle head units by other research teams.