A Video Call Can Now Hand Attackers the Keys to Your Android Phone

Key points

• Researchers at SSD Secure Disclosure published a working attack on August 17, 2026 that gives full control of an Android phone through a video call.
• The attack targets phones using Unisoc modem chips, a Chinese chipmaker whose parts are common in budget Android handsets.
• The chain has two stages: a March 2026 flaw in the modem, and a new August 2026 flaw that jumps from the modem into the phone's main operating system.
• Unisoc has not released a fix, and researchers say the attack needs no taps or clicks from the victim.
• Owners of affected phones cannot patch this themselves; carriers and phone makers will need to ship updates once Unisoc responds.

A researcher can now call your phone over 4G video, and walk out with everything on it.

That is the practical upshot of an advisory published by SSD Secure Disclosure on August 17, 2026, and picked up by The Hacker News. The write-up describes a two-step attack against phones that use Unisoc modem chips, the small radio processor inside a phone that handles calls and mobile data.

Step one was disclosed back in March. Step two, published this month, is the nastier half: it lets an attacker escape the modem and take control of the Android kernel, meaning the core of the phone's operating system that has authority over everything else.

Once you own the kernel, you own the phone. Photos, messages, banking apps, microphone, camera. All of it.

How does the attack actually work?

An attacker places a VoLTE video call to the target phone. VoLTE, short for Voice over LTE, is the standard way modern phones carry calls over 4G data instead of the old voice network.

The malformed call data hits the Unisoc modem and triggers the first bug, the March 2026 remote code execution flaw. That gives the attacker a foothold inside the modem chip itself.

The new August flaw is the bridge. It lets code running on the modem reach across into Android's kernel and take over. No app install, no dodgy link, no user tap. The phone just needs to be reachable on the mobile network.

Which phones are at risk?

Any Android phone using an affected Unisoc modem, and there are a lot of them. Unisoc chips show up heavily in budget and mid-range Android devices sold across Asia, Africa, Latin America and parts of Europe. Brands including Motorola, Samsung's low-end A-series, Nokia and several Chinese makers have shipped Unisoc-based models over the past few years.

SSD says Unisoc was notified and has not shipped a fix. That is the awkward part. Even if Google or a phone maker wanted to patch this next week, the fix has to come from the chipmaker first, then flow through the phone brand, then through the carrier, then to you.

Should ordinary phone owners be worried?

Worried, no. Aware, yes. Attacks like this are expensive to build and tend to get used against specific people: journalists, activists, executives, government targets. Random users are not the priority.

If you are in a higher-risk group and you own a Unisoc-based phone, the honest advice is to consider a different device until a firmware update lands. Turning off VoLTE where your carrier allows it will also cut the attack path, at the cost of call quality dropping back to older 3G or 2G voice.

For everyone else: keep automatic updates on, and check for a system update once Unisoc and your phone maker respond. This is the kind of flaw that gets quietly patched in a monthly Android security bulletin rather than announced on stage.

Would multi-factor authentication have helped here? Honestly, no. This attack sits below the apps where MFA lives. When the kernel is owned, the login prompt is theatre.