Android SMS vulnerability can crash phones without opening

A crafted WAP Push text can crash Android’s telephony service from Android 12 up; Google’s October 2026 updates cover Android 14 through 17.

A flaw known as SMS of Death (CVE-2026-58882) can crash Android phones via a specially crafted text without any tap or open.

It affects Android 12 and later by crashing the telephony service, dropping calls—including emergency calls—and interrupting cellular service.

About 20 malicious messages can leave a device practically unusable; a restart may not clear pending messages.

Google included a fix in October 2026 security updates for Android 14 through Android 17; Android 12 and 13 may stay exposed without a maker patch.

Researcher Mark Blaszczyk reproduced the issue on Google Pixel and Samsung Galaxy devices; theft of personal data was not shown.

Read the full story