A critical Android vulnerability known as the “SMS of Death” allows attackers to remotely crash smartphones by sending a specially crafted, invisible text message, without requiring any action from the victim. Tracked as CVE-2026-58882, the zero-click denial-of-service flaw was discovered by security researcher Mark Blaszczyk and reported to Google in May 2026. The vulnerability exists in Android’s WAP Push message-processing functionality, where improper validation of a message header can trigger a system error and crash the com.android.phone process responsible for cellular communications. As a result, victims can experience dropped calls, temporary loss of mobile connectivity, and potential disruptions to emergency calls, including 911. Repeated malicious messages can make matters worse by triggering continuous crashes and reboot loops, potentially leaving devices unusable and requiring a factory reset or specialized recovery procedures. Because the messages are processed before reaching the inbox, victims may never see the malicious texts or know what caused the disruption.
Google has developed a security fix for the vulnerability, identified as “Fix remote DoS in decodeWapPdu,” and included patches in its October and November 2026 Android security updates. The updates cover Android versions 14 through 17, although rollout depends on device manufacturers and supported models, leaving some users temporarily exposed. Older devices, particularly those running Android 13 or earlier, may not receive the necessary security updates and could remain permanently vulnerable. The researcher has also released proof-of-concept exploit code, increasing concerns about potential exploitation, although widespread attacks against ordinary users have not been established. Google and security experts recommend installing the latest available Android security updates, while users with unsupported devices should recognize that their phones may remain at risk. As the researcher explained, “The victim does nothing. No tap, no open, no notification,” highlighting the danger posed by zero-click vulnerabilities.
Read more about it here.