Unisoc Modem Flaws Chained to Hijack Android Phones via Video Call

Researchers have uncovered a dangerous exploit chain that leverages two previously undisclosed vulnerabilities in Unisoc cellular modems to remotely compromise Android smartphones. Unisoc chipsets power a significant share of budget and mid-range Android devices, particularly in emerging markets across Asia, Africa, and South America, making the attack surface for this flaw considerable. By chaining the two bugs together, attackers can deliver a malicious payload over the cellular network without requiring any user interaction beyond answering an incoming video call.

The attack begins when the attacker places a specially crafted video call to the target device. During the call setup and media negotiation phase, the malicious payload is delivered through the modem's baseband processor, exploiting a memory corruption vulnerability to achieve initial code execution at the firmware level. Once the baseband is compromised, the exploit chain pivots to a second vulnerability—typically a privilege escalation or sandbox escape flaw—that grants the attacker access to the main Android operating system. From there, the attacker can install surveillance software, exfiltrate contacts, messages, and location data, or activate the microphone and camera, all while the victim remains unaware.

What makes this exploit chain particularly concerning is the minimal user interaction required. The victim simply needs to accept the incoming video call—no link clicks, no app installations, and no permission grants. Because the compromise occurs at the modem layer, traditional Android security controls and even many mobile device management (MDM) solutions have limited visibility into the attack. Security researchers have advised Unisoc that patches have been developed and are being distributed to device manufacturers, though the fragmented Android update ecosystem means many affected devices may remain vulnerable for months.

Mobile users can take proactive steps to reduce exposure to cellular-level threats. Running periodic checks with a DNS leak test can help identify unexpected network traffic routing, while a port scanner can verify that no rogue services are listening on the device. For a comprehensive review of your overall security posture, our privacy checkup tool provides actionable recommendations to harden your mobile and desktop environments against similar sophisticated attack chains.