An invisible SMS of Death attack can interrupt Android phone calls and leave vulnerable devices stuck in repeated crashes, security researcher Mark Blaszczyk warns. His findings describe an attack that requires no user interaction and could force affected owners to reset their phones.
Hidden Messages Crash Android’s Phone Service
The vulnerability involves WAP Push, a legacy messaging mechanism that supports functions such as MMS delivery and carrier settings. Unlike ordinary texts, these messages can trigger background processing without appearing in the inbox. Consequently, victims may receive no visible warning before their mobile service fails.
According to Blaszczyk, a malformed message crashes Android’s com.android.phone component, which handles telephone services. This can immediately disconnect an active call, including one to emergency services. Furthermore, the attack requires no link clicks, downloads or message opening.
The underlying problem involves an unchecked conversion between numeric data types. Android processes a message header length and converts it into a smaller integer type. However, the conversion produces a negative value, triggering an error that terminates the phone service.
SMS of Death Can Cause Persistent Disruption
Initially, the service interruption may last only one or two seconds while the affected component restarts. However, the phone may fail to acknowledge the message before crashing. As a result, the carrier can attempt delivery again, repeating the disruption.
The malformed message can also remain in the device’s pending message queue. Consequently, restarting the handset may trigger another crash when Android attempts to process it again. Repeated malicious messages can therefore turn a brief interruption into a prolonged denial of service.
Blaszczyk reported reproducing the problem consistently on a Pixel 9 running April 2026 firmware and several Samsung Galaxy A-series devices. In more severe cases, Android’s RescueParty recovery mechanism eventually sends the handset into recovery mode. Users may then face a factory reset, which erases local data.
Nevertheless, a reset is not necessarily the only recovery option. The researcher described a more technical approach involving Android Debug Bridge and clearing affected data during a short startup window. This requires access from another computer and may prove difficult for ordinary users.
Patch Availability Depends on the Device
The researcher reported the vulnerability to Google in May 2026. Google subsequently committed a fix on June 15 and added it to the Android Open Source Project. However, the supplied report states that the correction had not reached every supported handset.
The report identifies Android 12 through 16 as affected and names the flaw CVE-2026-58882. Meanwhile, GrapheneOS said October 2026 updates addressed the issue in Android 14 through 17, with inclusion in the November security bulletin expected. These release details do not establish that every manufacturer has delivered the fix.
Public proof-of-concept code now demonstrates the SMS of Death attack, increasing concern about disruption to vulnerable phones. Devices that no longer receive security updates may remain exposed. Although the attack can leave a handset temporarily unusable, the reported behaviour involves software crashes and recovery problems rather than permanent hardware damage.
0 responses to “SMS of Death Traps Android Phones in Reboot Loops”