#ICYMI: Android bug lets hidden text message drop calls

A researcher says Google dismissed his report, but Android’s code records show a fix was developed in June.

Photo from Google

Flaw dubbed "SMS of Death"

A newly disclosed Android vulnerability dubbed "SMS of Death" lets attackers remotely disrupt phones without any action from the victim, according to Android Authority.

Security researcher Mark Blaszczyk discovered the flaw, which involves a specially crafted text message that Android has trouble processing. The message never appears in the inbox, so the user gets no notification and sees no unfamiliar sender.

Instead, the message crashes the system that handles phone calls. Any ongoing call is disconnected immediately, including calls to emergency services.

Android can keep trying to process the same message, so the crash can repeat. Blaszczyk said around 20 such messages can leave a phone practically unusable and potentially stuck in a bootloop.

A factory reset may not help if the carrier resends the messages. Recovering without wiping the phone may require connecting it to a computer and clearing the messages manually.

Blaszczyk reproduced the attack on Google Pixel and Samsung Galaxy devices. The vulnerable code dates back to Android 12. Whether a device is at risk depends on whether it has received the fix, and older Android versions that no longer get security updates may remain exposed.

Blaszczyk said he alerted Google on May 5, but that Google repeatedly dismissed his report as a non-security issue. He publicly disclosed the vulnerability and released a working demonstration on October 29.

Android’s own code records show Google had already developed a fix on June 15. The updated software handles the error and removes the problem message before it can cause more damage. GrapheneOS said on X that Google distributed the fix through security previews in July, months before the public disclosure.

The vulnerability is tracked as CVE-2026-58882 and carries a Critical severity rating. It is apparently scheduled to be included in November’s Android Security Bulletin.

Google has not publicly explained why the report was dismissed even though a fix existed. Possible explanations include an internal communication breakdown, perhaps involving a duplicate report.

Blaszczyk said Google included the fix in October's Android security updates for versions 14 through 17. GrapheneOS said the vulnerability is scheduled for November's security bulletin, having already received the underlying fix through Google's July previews.

What do you think?

Via: Android Authority