A newly found security flaw in the Android operating system lets malicious actors crash smartphones by delivering a specific text message, with zero action needed from the person receiving it. Security researcher Mark Blaszczyk uncovered the issue, which impacts how Android processes particular SMS messages, capable of dropping active phone calls, cutting off cellular service, and rendering devices completely unusable. Tracked as CVE-2026-58882 and called the SMS of Death, this vulnerability impacts Android versions starting with Android 12. Google created a patch, but older phones and those missing recent security updates stay at risk.
How the SMS of Death Attack Works
The security hole involves a specially designed WAP Push SMS message. WAP Push technology lets mobile carriers send specific data directly to the operating system of a phone. Unlike standard text messages, these run automatically in the background and might not show up in the inbox of a user. Blaszczyk found that a broken message crashes the telephony service of Android, which manages cellular connections and phone calls. Consequently, active calls drop instantly, including calls made to emergency services. Cellular connectivity can also vanish briefly while Android tries rebooting the broken service. The attack raises concern because targets do not need to interact, open messages, click links, or download software.
Multiple Messages Can Make Phones Unusable
According to the researcher, taking in multiple malicious texts creates worse complications. Android may keep trying to process the identical message, sparking more crashes. During testing, about 20 targeted messages rendered a device practically unusable, sparking continuous crashes or reboot loops. Rebooting the impacted phone might fail to fix the issue because the harmful messages stay pending. Sometimes, recovery demands plugging the device into a computer and applying specialized Android debugging tools to delete the bad messages. The researcher tested and reproduced the problem on Google Pixel and Samsung Galaxy phones. Still, the flaw resides in the core telephony software of Android, meaning devices from other makers face potential risks too. The demonstrated attack breaks device availability, though it has not proven capable of stealing personal data or granting attackers access to private files.
Google Has Developed a Security Fix
Blaszczyk reported the vulnerability to Google in May 2026. Even though the vulnerability reporting program of Google labeled the report a non-security matter, Android engineers later created a software patch. Based on the disclosure by the researcher, the patch arrived in the October 2026 security updates for devices running Android 14 through Android 17. The updated code stops the broken message from crashing the telephony service repeatedly and clears out the problematic message. Yet, the patching timeline for the vulnerability remains somewhat unclear. The problem is also scheduled for inclusion in the November 2026 Android Security Bulletin by Google. Security patches arrive on smartphones at different times based on manufacturer policies and software support.
Devices running Android 12 or Android 13 may stay exposed if manufacturers fail to release a proper fix.
How to Protect Your Android Phone
Android users need to verify if their phones have received the newest available security updates. To look for updates, users must open Settings, find the system or software update menu, and install any available security patches. Users should also inspect the Android security patch level of their device to see how recently it got updated. Phones operating on Android 14 or newer should get the corresponding fix via supported security updates, though availability relies on the manufacturer. For older devices that stopped getting security updates, fixing the vulnerability may be impossible through simple means. Because the attack works without user involvement, ignoring suspicious links or messages fails to block it. Installing the correct security patch serves as the best defense against the SMS of Death vulnerability.
