Android Takeover Flaw Found in Unisoc Modems via Video Call
Researchers have demonstrated how a pair of vulnerabilities in Unisoc’s modem chips can be chained to remotely compromise Android devices—simply by getting the victim to answer a video call. The exploit requires no user interaction beyond accepting the call, making it a stealthy route for attackers to gain control of phones running certain Unisoc-based chipsets.
How the exploit works
The attack combines two separate flaws: one that allows unauthenticated remote code execution in the modem’s audio processing, and a second that escalates privileges once malicious code is running. By sending a specially crafted video call packet, an attacker can deliver a payload to the device’s modem without the Android OS ever seeing the traffic. When the victim answers, the modem executes the payload and hands control back to the attacker.
Who is affected—and what’s at stake
The vulnerabilities primarily target phones equipped with Unisoc’s T700, T760, and T770 modem chipsets, which are widely used in budget and mid-range Android devices. While Google has issued patches through its Android Security Bulletins, distribution depends on device manufacturers, leaving many users exposed. Security firms warn that the exploit chain could be weaponized in targeted attacks, especially against users in regions where Unisoc-based phones dominate the market.
Why it matters
This isn’t just another theoretical flaw—it’s a practical, low-interaction path to full device takeover. For users with vulnerable modems, the risk isn’t limited to data theft; compromised devices can be silently enrolled in botnets or used as surveillance nodes. The episode also highlights the hidden dangers of modem-level vulnerabilities, where flaws can bypass Android’s sandboxing and remain undetected by typical security software. Until more devices receive updates, the exploit chain serves as a reminder to treat every incoming call—even a video one—with caution.
Source: Dark Reading. AI-assisted editorial synthesis — TechnoExpress.