A security researcher has uncovered a serious vulnerability in Android that allows an attacker to remotely crash a smartphone using a specially crafted text message. Dubbed “SMS of Death,” the flaw can disrupt cellular services, disconnect ongoing calls, and even leave a phone stuck in a reboot loop. The troubling part is that the recipient doesn’t have to interact with it at all.
The flaw, tracked as CVE-2026-58882, was discovered by security researcher Mark Blaszczyk, who first notified Google about it in May. On October 29, he published his findings alongside a working demonstration, after successfully reproducing the attack on Google Pixel and Samsung Galaxy smartphones. Google has already developed a fix, but its availability across Android devices is another matter.
Should every Android user be worried?
The pool of affected devices is not limited to a particular Android brand, as what matters here is the version of Android running on the phone and whether it has received the necessary security patch. Blaszczyk says the fix has already reached Android 14 through 17 as part of Google’s October 2026 security updates. However, the company didn’t mention the vulnerability in its October security bulletin.
The researcher emphasized that older Android phones running Android 12 and 13 haven’t received the fix, which leaves those without ongoing security support exposed to the attack. For everyone else, checking the security patch level and installing the latest available Android update is the best precaution. The information can usually be found in the Settings menu, although the exact location differs depending on the manufacturer.
It’s also worth clarifying that this is a denial-of-service vulnerability, and not an exploit designed to steal passwords or personal information. So far, there is no confirmed evidence of widespread attacks targeting Android users.
How can a text message crash an Android phone?
The issue at heart is how Android processes WAP Push messages, which are handled by the operating system without appearing in the regular SMS inbox. Ordinarily, the user doesn’t have to do anything with these messages. But Blaszczyk found that a malformed message can trigger an error in Android’s telephony framework, bringing down the process responsible for cellular connectivity.
In this case, the crash can disconnect an ongoing phone call, including one made to emergency services. Moreover, if the carrier attempts to deliver the same message again, the phone can end up crashing repeatedly. During testing, around 20 malicious messages were enough to leave a smartphone stuck in a reboot loop.
A factory reset isn’t the only way to recover the device. However, the alternative involves using Android Debug Bridge (ADB) to clear the offending messages, which isn’t something an average smartphone user would be familiar with.
RELATED COVERAGE: