This post is also available in:
עברית (Hebrew)
Smartphones separate their cellular modem from the main operating system partly to prevent problems in one component from compromising the entire device. New security research suggests that this boundary may be dangerously weak in several widely used mobile processors, potentially allowing malicious cellular traffic to reach Android’s most privileged software.
Researchers demonstrated the vulnerability on smartphones powered by several Unisoc chipsets, including the T612, T616, T606 and T7250. The affected modem software is reused across multiple entry-level Android devices. Tests successfully demonstrated the exploit on the Realme C33 and confirmed it on the Xiaomi Redmi A5 and Motorola E13.
The attack begins with a VoLTE video call, but it is more complicated than simply dialing the victim. The researchers created specially malformed signaling messages using Session Initiation Protocol (SIP), the technology cellular networks use to establish and manage calls.
According to Cyber News, malicious code is hidden inside fields normally used to exchange call and media information. Because individual messages can carry only limited amounts of data, the payload is divided into approximately 1,200-byte fragments and delivered through multiple SIP INVITE messages.
If the targeted user answers the video call, the modem processes the crafted data and can inadvertently execute the attacker’s code. An initial component described as an “egg hunter” searches modem memory for the scattered payload fragments and reconstructs them.
The deeper problem is insufficient isolation between the modem and Android’s kernel memory. According to the disclosure, code executing within the compromised modem can disable protections in a Memory Protection Unit region, gaining the ability to read and write across the device’s memory. This could allow an attacker to modify the Android kernel, effectively reaching the operating system’s most privileged level.
There is an important limitation. The proof of concept was demonstrated entirely on researcher-controlled VoLTE infrastructure using rooted devices. It has not been shown to work across a real commercial carrier network, where additional network controls could affect the attack. Claims that any ordinary video call can currently compromise vulnerable phones in the wild therefore remain unproven.
The vulnerability nevertheless has broader security implications. Smartphones are routinely used by government personnel, military units and critical-infrastructure employees for communications and authentication. A modem-level weakness is particularly concerning because cellular components operate below many conventional mobile-security protections.
According to the disclosure, attempts to contact Unisoc received no response. As of its publication on August 17th, 2026, no CVE identifier or patch status had been announced, while proof-of-concept exploit code had been made public.
The research highlights an often-overlooked part of smartphone security: protecting Android itself is not enough if the cellular hardware beneath it can provide another route into the system.
