The Android SMS of Death is a newly disclosed flaw that lets a malformed text crash a phone’s calling service without ever appearing in the inbox. Researcher Mark Blaszczyk disclosed it on October 29, 2026, after alerting Google on May 5, 2026. Android Authority reports the message can drop ongoing calls, including emergency calls, with no action from the victim.
Key Takeaways
- A hidden WAP Push text can crash Android’s phone process and drop calls.
- About 20 messages can trap a phone in a reboot loop.
- Google no longer supports Android 12 and 13, so they may stay unpatched.
- October’s patch timing is disputed; check again in November.
What the Android SMS of Death Does
Blaszczyk, who posts as @sourone, traced the crash to a malformed WAP Push SMS. That legacy carrier channel can deliver hidden instructions, such as an MMS prompt or carrier settings, without a tap. The text never appears in the inbox, and the sender’s number is not shown. Cybernews quotes him: “A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls), with zero interaction from the victim.”
Each crash knocks out mobile service for about one to two seconds, until the phone process restarts. Carriers resend the SMS because the handset never acknowledged it, and Android retries the queued message on every boot. Around 20 texts can leave a phone practically unusable.
RescueParty, an automatic recovery feature, can reboot the device into recovery after roughly 90 seconds. He reproduced the attack every time on a Pixel 9 running April 2026 firmware and on Samsung Galaxy A-series phones. Heise Online, citing Blaszczyk, calls the flaw “a remote, zero-click denial-of-service attack with persistent effects.” In his tests, a single resent text caused intermittent outages for up to a week.
Which Phones Still Lack a Fix
Cybernews says the flaw affects Android 12 through 16. Heise reports 12 through 17, and AndroidPure says tests ran from 12 up to 16. Blaszczyk says the October fix covers Android 14 through 17, leaving 12 and 13 out. Heise notes Google no longer supports those releases, so they will very likely stay vulnerable unless a maker backports a patch.
| Android version | Share of active devices | Fix status in reports |
|---|---|---|
| Android 12 | 9.6% | No Google fix; support ended |
| Android 13 | 11.8% | No Google fix; support ended |
| Android 12 and 13 | 21.4% | About one in five devices |
| Android 14 through 17 | Not stated | October fix claimed; November listing expected |
Those shares come from AndroidPure’s reading of Google’s distribution data. They count versions, not patch levels, so an Android 14 or newer phone without a recent update can still be exposed. AndroidPure cautions Pixel owners not to assume October’s Android 17 patch includes this fix. Older handsets have aged out of updates before, including when Google Play Services ended support for Android Jelly Bean.
Google’s Patch and the Dismissed Report
Blaszczyk reported the bug on May 5, 2026. Google repeatedly treated it as a non-security issue and closed the report as “Will Not Fix,” Heise reports. Engineers still wrote a fix on June 15 that handles the error and deletes the bad message so it cannot keep crashing the phone.
GrapheneOS said Google sent the fix in July security previews, months before disclosure, and implemented it the same month. Heise says it was checked in on August 5 and reached the public Android Open Source Project repository in October. GrapheneOS speculated the report was closed by mistake, possibly meant as a duplicate rather than a rejection.
Blaszczyk says October 2026 updates for Android 14 through 17 include the fix. Android Authority says CVE-2026-58882 carries a Critical rating and is apparently slated for November’s bulletin, a timing GrapheneOS also described. AndroidPure notes the CVE was not in Google’s October bulletin, and that MITRE had not published the record as of October 30. Android Authority asked Google about the timeline and had no reply when it published.
What Android Owners Should Do
For most people, the protection is the update, not a recovery trick. Install the newest security patch the phone offers, then check again in November.
- Check the security patch date in Settings.
- Install the newest system update offered.
- Look again in November for the bulletin entry.
- If recovery appears, do not choose “Wipe data.”
A factory reset may not last if the carrier resends the same messages, Android Authority reports. Clearing them without a wipe can require a computer and Android Debug Bridge in a short window after boot. Choosing “Wipe data” erases the phone. That is why update promises such as Vivo’s three years of flagship updates matter: a hidden text can drop an emergency call on a phone the maker no longer patches.
