Android’s ‘SMS of Death’ can crash phones with no user interaction
Security researcher Mark Blaszczyk found that a malformed text message can crash Android’s cellular process, disrupting service and disconnecting calls, including emergency calls. BleepingComputer says Google patched the flaw in October 2026 updates for Android 14 through 17, but Android 12 and 13 remain vulnerable; the researcher has published a working proof of concept.
Bottom line — About 20 malicious messages were enough to put tested phones into reboot loops.
Go deeper 6
-
The flaw, CVE-2026-58882, affects how Android processes WAP Push messages before they appear in the SMS inbox.
-
Digital Trends reports the researcher reproduced the attack on Google Pixel and Samsung Galaxy phones.
-
BleepingComputer says carrier redelivery can trigger repeated crashes; the patch also removes malicious messages from the SMS database.
-
Google’s October security bulletin did not mention the vulnerability, according to both reports.
-
Android updates may depend on device manufacturers and carriers, BleepingComputer notes; a restart may be needed to complete installation.
-
BleepingComputer says recovery can require a factory reset, though a GitHub contributor described a more technical ADB method to delete the offending messages.