DIGITAL LIFE

Invisible SMS can drop calls on Android phones

A vulnerability in Android allows phone calls to be interrupted via an "invisible" SMS—a specially crafted text message that requires no user interaction, such as opening the message or receiving a notification. The flaw, dubbed "SMS of Death," affects how WAP Push messages are processed and can terminate ongoing calls, including those made to emergency services.

Security researcher Mark Blaszczyk disclosed the technical details of the issue following a communication process with Google that began in May 2026. The vulnerability was reproduced on a Google Pixel 9 and several Samsung Galaxy devices. Although Google has developed a fix, questions remain regarding its distribution across various manufacturers.

An invisible SMS crashes Android phones, cuts off calls, including to emergency services, and can trap users in a reboot loop, a researcher warns. The “SMS of Death” exploit code is now public, and the fix is underway.

Simply invisible SMS messages can make Android phones unusable, requiring a factory reset or an involved recovery procedure, a new security advisory warns.

“A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls), with zero interaction from the victim,” Mark Blaszczyk, a security researcher (@sourone), said in a report.

And attackers can already leverage SMSes to target victims using a proof-of-concept “SMS of Death” app, made available on GitHub – it remotely and silently sends a crafted 8-byte WAP Push PDU over SMS to a target handset.

The bug requires no user interaction, the exploit works remotely, and often bricks the device – recovery requires connecting to the phone using Android Debug Bridge (ADB), according to the researcher. The attack is completely invisible, and the SMS messages don’t appear in the inbox.

The author disclosed the bug responsibly in May, 2026. Google committed a fix on June 15 and pushed the patch to the Android Open Source Project (AOSP), but the fix has yet to reach all supported devices.

The critical vulnerability affects Android 12 through 16, meaning that many phones will never receive a fix.

GrapheneOS said the bug will be included in the upcoming November security bulletin. The critical flaw is patched in Android 14–17 with the October 2026 update. It has been assigned CVE-2026-58882.

How does the bug work? The entire payload is just eight bytes sent via SMS, and five of those bytes represent a single number – the header’s length.

When the phone receives the SMS and starts processing it automatically, it sees a valid value: 2,147,483,648, in a format known as long (0x80000000), which is used for large numbers.

However, Android then converts it to a smaller data type, a 32-bit integer (int), without checking the range, causing overflow. The number flips to a negative value (-2,147,483,648) after conversion, which makes no sense as a header length.

The negative value triggers a fatal error, killing com.android.phone, a component that handles calls.

WAP Push is a legacy system that lets mobile carriers send hidden instructions to phones without the user taking any action, such as prompting devices to download MMS or apply carrier settings.

The attack exploits a flaw in the processing of WAP Push messages—a mechanism used by mobile networks to transmit specific types of information to mobile phones.

According to security researcher Mark Blaszczyk, a specially crafted message can cause a failure in the `com.android.phone` process, which handles essential telephony functions on Android.

The issue stems from an incorrect interpretation of a message header's length. When the system receives certain malformed values, an exception can occur, causing the telephony process to crash.

A unique aspect of this vulnerability is that the attack requires no interaction from the victim. The message is processed automatically, without ever appearing in the user's inbox or triggering a visible notification.

In tests conducted by the researcher, the flaw caused a temporary disruption to telephony services—enough to terminate an active call. The issue could even affect calls to the European emergency number 112 if a malicious message is received while the call is in progress.

Repeated messages can prolong the disruption; the consequences are not necessarily limited to the interruption of a single call. An analysis published by eSecurity Planet outlines the risks associated with the repeated transmission of malicious messages, which can trigger further failures in telephone service.

Blaszczyk documented instances where repeated attacks rendered equipment temporarily unable to perform standard telephony functions. The researcher also noted that certain message-resending mechanisms can exacerbate the issue.

The extent of these consequences, however, depends on the specific hardware, the version of Android, and the conditions under which the attack occurs. The tests presented do not indicate that all Android phones exhibit the same behavior.

The vulnerability constitutes a denial-of-service attack. The findings provide no evidence that it allows for access to personal data, the installation of applications, or the complete takeover of a device.

The timeline of the vulnerability reveals discrepancies between the initial assessment of the issue and Google’s technical response.

Blaszczyk reported the flaw in May 2026. According to the researcher, the incident was initially categorized within Google’s vulnerability identification program as an issue with no security implications.

Despite this classification, development records indicate that a fix intended to address the vulnerable behavior had already been prepared by June.

The fix modifies how malformed messages are handled, preventing specific errors from causing an interruption to telephone service.

However, the existence of a fix within the Android codebase does not guarantee that it has reached all devices.

Android Authority examined the status of the fix and found conflicting information regarding the rollout schedule. While some references point to the October updates, others link the resolution to the November security cycle.

The GrapheneOS project also included a fix for this vulnerability in its early security releases, as documented in its official update history.

The distribution of the fix to Android devices depends on the manufacturers, the operating system versions, and their respective update schedules. What Android users should do...The primary protective measure is to keep the operating system up to date and install the security patches provided by the manufacturer.

Users can check their security update level in their phone's settings, though the exact location of this information varies depending on the manufacturer and the version of Android.

Security updates are particularly important because some vulnerabilities can be exploited without any user intervention. Even so, the presence of a recent update does not, by itself, guarantee that a specific patch has been installed.

The rollout of these updates may also vary between different models. As previously reported by TecheNet, some Google Pixel devices experienced issues following the September update—an incident that is separate and has no known connection to the vulnerability now being disclosed.

To date, the available information describes security tests and technical demonstrations. There has been no confirmation of an active exploitation campaign targeting Android users via this flaw.

However, the release of technical details underscores the importance of deploying the fixes, especially since the issue could affect a critical mobile phone function and disrupt emergency communications.

mundophone