A newly disclosed Android SMS vulnerability lets an attacker crash a smartphone by sending a specially crafted text, without the owner opening the message or tapping anything. Researcher Mark Blaszczyk found the flaw, nicknamed “SMS of Death” and tracked as CVE-2026-58882. It hits Android’s handling of certain SMS traffic from Android 12 onward and can drop live calls, interrupt cellular service, and, with repeated messages, leave a handset hard to use.
How the SMS of Death attack works
The attack uses a malformed WAP Push SMS. WAP Push is a network messaging method that can deliver data straight to the phone’s operating system. Unlike ordinary inbox texts, these messages can be processed in the background and may never show up for the user to read.
Blaszczyk found that a bad message can crash Android’s telephony service—the software that manages calls and cellular links. An active call can cut off at once, including a call to emergency services. The phone may also lose cellular connectivity for a time while Android tries to restart that service. No link click, app install, or inbox open is required.
Repeated delivery makes the problem worse. Android may keep trying to process the same bad message and crash again. In testing, roughly 20 specially crafted messages were enough to leave a device practically unusable, with repeated crashes or reboot loops. Restarting alone may not help, because the messages can stay pending. In some cases, recovery needs a computer and specialised Android debugging tools to clear them.
The researcher reproduced the issue on Google Pixel and Samsung Galaxy phones. Because the bug sits in Android’s underlying telephony software, other makers’ devices may be affected too. The demonstrated attack hits availability. It has not been shown to steal personal information or open private files.
Google’s fix and how to protect your phone
Blaszczyk reported the issue to Google in May 2026. Google’s vulnerability reporting programme first treated it as a non-security issue, but Android engineers later built a software fix. The researcher’s disclosure says the fix is in October 2026 security updates for devices on Android 14 through Android 17. The update stops the malformed message from crashing the telephony service again and removes the problematic message. The issue is also reportedly lined up for Google’s November 2026 Android Security Bulletin. Patch timing still varies by manufacturer and support policy. Phones on Android 12 or Android 13 could stay exposed if makers do not ship a suitable fix.
Users should open Settings, go to the system or software update section, and install any available security patches, then check the device’s Android security patch level. Supported phones on Android 14 or later should get the relevant fix when their maker ships it. For older handsets that no longer receive updates, there may be no straightforward way to close the hole. Because the Android SMS vulnerability needs no user action, simply avoiding suspicious links is not enough. Installing the proper security patch remains the strongest defence.
Timeline: what has happened so far
- May 2026: Mark Blaszczyk reported the vulnerability to Google.
- October 2026: A fix was included in security updates for Android 14 through Android 17.
- November 2026: The issue is reportedly scheduled for Google’s Android Security Bulletin.
Aasan alfaaz mein
Android phone par ek naya SMS khatra milta hai jise SMS of Death kehte hain. Bina message khole bhi khas tarike ka text phone ki call aur network service crash kar sakta hai. Android 14 se 17 tak October 2026 ke security update se iska ilaj aaya hai—Settings se update check karein. Purane phones jinhein update nahi milta, unhein zyada khatra rehta hai.
