A newly disclosed flaw in Android can bring a smartphone to a standstill with nothing more than a specially crafted text message, and the person receiving it does not have to open anything, tap anything or download anything for it to work. The attack, described by the researcher who found it as an SMS of Death, targets the part of Android that handles phone calls and mobile connections. It can cut off a call in progress, including a call to an emergency number, interrupt cellular service and, if repeated, leave a handset practically unusable.
The vulnerability, tracked as CVE-2026-58882, affects Android versions from Android 12 onwards, according to the disclosure. It was discovered by researcher Mark Blaszczyk, who found that a malformed message could crash Android’s telephony service, the background system that manages calls and the phone’s link to the mobile network. Because that service is so central, its failure is felt at once. A call can drop without warning and the phone can briefly lose its cellular connection while Android tries to restart the service and recover. The demonstrated danger is not that private photos or messages are stolen. It is about availability: the phone stops working as a phone, and it does so silently, with nothing on screen to explain why.
How the SMS of Death Attack Works
The attack uses a type of message known as a WAP Push SMS. WAP Push is an older messaging technology that lets a mobile network deliver certain kinds of information straight to a phone’s operating system rather than simply dropping a readable text into the inbox. Unlike an ordinary message, which waits for the user to read it, these messages are processed automatically in the background, and they do not necessarily appear in the inbox at all. That automatic handling is what makes the flaw so awkward, because the phone does its work before the owner has any chance to judge whether a message looks suspicious. The usual advice about not clicking strange links simply does not apply here.
Multiple Messages Can Make Phones Unusable
The picture becomes much more serious when the attack is repeated. According to the researcher, sending the malicious message again and again can keep triggering crashes, because Android may repeatedly attempt to process the same message. In testing, around twenty specially crafted messages were enough to leave a device practically unusable, with repeated crashes or reboot loops. Restarting the phone may not fix the problem either, because the offending messages can remain pending and trouble the phone again as soon as it starts up. In some cases, recovery may require connecting the handset to a computer and using specialised Android debugging tools to clear the problematic messages, a step well beyond what most owners would ever attempt on their own.
Google Has Developed a Security Fix
Blaszczyk first reported the vulnerability to Google in May 2026. Google’s vulnerability reporting programme initially classified the report as a non-security issue, but Android engineers went on to develop a software fix all the same. According to the researcher’s disclosure, that fix has been included in the October 2026 security updates for devices running Android 14 through Android 17. The updated software stops the malformed message from repeatedly crashing the telephony service and removes the problematic message, closing off the loop that made repeated attacks so damaging. The researcher reproduced the problem on Google Pixel and Samsung Galaxy handsets, and because the flaw sits in shared Android telephony software, other makers’ devices may also be affected. The issue is also reportedly scheduled for Google’s November 2026 Android Security Bulletin, and updates reach phones at different times by manufacturer, leaving Android 12 and 13 devices exposed if makers provide no fix.
How to Protect Your Android Phone
For most Android owners, the practical advice is simple, even if it is not entirely in their control. Check whether the phone has received the latest available security update, and install it. That means opening Settings, finding the system or software update section, and installing any available security patch, then checking the device’s Android security patch level to see how recently it was updated. Phones running Android 14 or later should receive the relevant fix through supported security updates, although exactly when it arrives still depends on the manufacturer.
For older devices that no longer receive security updates, there may be no easy answer, and that is the uncomfortable part of this story. Avoiding suspicious links or messages, however sensible in general, is not enough here, because the attack needs no interaction from the victim at all. Installing the appropriate security patch remains the most effective protection, and for anyone whose phone is still supported, keeping it updated is the single most useful step. What makes this disclosure worth taking seriously is the assumption it overturns: that a message you never open cannot hurt you. The fix exists and the rollout is under way, and the gap between the two is where the risk lives.
