Home · Technology · Oct 30 archive
Android SMS of Death Vulnerability Discovered
Confirmed
In Short: Security researcher Mark Blaszczyk discovered a critical vulnerability in Android that allows attackers to crash phones with a single text message.
Security researcher Mark Blaszczyk discovered a critical vulnerability in Android that allows attackers to crash phones with a single text message, dubbed 'SMS of Death.'
The flaw, which involves a specially crafted text message, crashes the system that handles phone calls, immediately disconnecting ongoing conversations, including calls to emergency services.
According to Blaszczyk, around 20 such messages can leave a phone practically unusable, potentially trapping it in a bootloop.
Unlike a normal SMS, the malicious message never appears in the inbox, making it difficult for users to detect or trace.
The bug sits in WapPushOverSms, the part of Android’s telephony framework that processes WAP Push messages.
Google included a fix in October’s Android security updates for versions 14 through 17, but Blaszczyk reported the issue through the Android and Google Devices Vulnerability Reward Program on May 5, 2026.
Google marked the report 'Won’t Fix' and treated it as a non-security issue, according to Blaszczyk’s disclosure site.
GrapheneOS, a privacy-focused Android distribution, shipped the fix in its own security preview releases in mid-July and will include it in the November 2026 Android Security Bulletin.
The carrier also resends texts the phone never acknowledges, causing repeated outages for up to a week in testing.
Blaszczyk argued that an attacker who can induce this state remotely could effectively bar a victim’s phone from service.
A Google engineer authored a patch on June 15 that is now public in the Android Open Source Project.
From then on, com.android.phone crashes on every boot as it reads the damaged store, with no new message required.
Background
Apps like Zuckoff and Antizuck Smart Glasses Scanner notify users when smart glasses are nearby, while GasBuddy helps track gas prices.
What's confirmed
- The flaw, which involves a specially crafted text message, crashes the system that handles phone calls, immediately disconnecting ongoing conversations, including calls to emergency services.
- According to Blaszczyk, around 20 such messages can leave a phone practically unusable, potentially trapping it in a bootloop.
- Unlike a normal SMS, the malicious message never appears in the inbox, making it difficult for users to detect or trace.
- The bug sits in WapPushOverSms, the part of Android’s telephony framework that processes WAP Push messages.
- Google included a fix in October’s Android security updates for versions 14 through 17, but Blaszczyk reported the issue through the Android and Google Devices Vulnerability Reward Program on May 5, 2026.
- Google marked the report 'Won’t Fix' and treated it as a non-security issue, according to Blaszczyk’s disclosure site.
- GrapheneOS, a privacy-focused Android distribution, shipped the fix in its own security preview releases in mid-July and will include it in the November 2026 Android Security Bulletin.
- The carrier also resends texts the phone never acknowledges, causing repeated outages for up to a week in testing.
- Blaszczyk argued that an attacker who can induce this state remotely could effectively bar a victim’s phone from service.
- A Google engineer authored a patch on June 15 that is now public in the Android Open Source Project.
- From then on, com.android.phone crashes on every boot as it reads the damaged store, with no new message required.
What's still developing
- Somewhere in the background, however, a text message you never received has just brought your phone’s calling service to its knees.
- According to Android’s own code records, the company developed a fix on June 15.
- Imagine dialing 911, only for your phone to suddenly drop the call.
- You haven’t pressed anything, your signal hasn’t disappeared, and there’s no obvious explanation.
- That’s the frightening scenario behind SMS of Death, a newly disclosed Android vulnerability that lets attackers remotely disrupt phones without the victim lifting a finger.
- Because Android can keep trying to process the same malicious message, the crash can happen repeatedly.
- Affiliate links on Android Authority may earn us a commission.
- We couldn't find any blog articles matching your search.
- That throws an uncaught NegativeArraySizeException and kills the com.android.phone process.
- Android then tries to create a byte array of that size.
- But a dropped call might be the least of your worries.