A security researcher has published details of an Android flaw he calls SMS of Death. One malformed text message, which never shows up in your inbox, crashes the phone’s calling service. Any active call drops, including emergency calls, and the victim doesn’t have to tap anything.
Google has a fix, but the researcher says it was released only for Android 14 through 17. By our maths from Google’s own distribution data, Android 12 and 13 together run on about one in five active Android devices.
How the Android SMS of Death flaw works
The researcher, Mark B (@sourone), reported the bug to Google on May 5, 2026. Android Authority gives his full name as Mark Blaszczyk. He disclosed the flaw publicly on October 29.
The bug sits in WapPushOverSms, part of Android’s telephony framework. A malformed WAP Push SMS crashes com.android.phone, the system process that handles calls. The message never appears in Messages, and the sender’s number isn’t shown.
Each message knocks out mobile service for one to two seconds. Carriers keep re-delivering it, so the crash repeats. In the researcher’s testing, that caused intermittent outages for up to a week.
About 20 messages can leave a phone unusable for an extended period. The phone retries the message on every boot, so it can reboot into recovery roughly every 90 seconds. Getting out of that loop needs a computer and ADB. The researcher also warns against choosing the wipe data option at the recovery prompt.
He tested the attack on a Pixel 9 running April 2026 firmware and on various Samsung Galaxy and A-series phones. He reports that it reproduced every time, on Android 12 up to Android 16.
Which Android versions get the fix
The researcher describes the version gap in his writeup:
Google’s October 2026 fix was released for Android 14 through 17, so devices on older versions outside the security-update window, such as Android 12 and 13, run the same code and do not receive the fix.
The October timing in that line is disputed. Android Authority reports that the fix appears to be slated for Google’s November Android Security Bulletin instead. It cites GrapheneOS, which says the fix went to phone makers in July security previews, with the CVE scheduled for November.
The bug is tracked as CVE-2026-58882, per Android Authority, which also reports a Critical rating. That CVE is not listed in Google’s October 2026 security bulletin. MITRE had not yet published the CVE record as of October 30.
A Google engineer wrote the code fix in June, and it was committed to the Android Open Source Project in August. The commit, flagged as a CVE fix, catches the crash and deletes the bad message from the phone’s raw SMS database.
The researcher also says Google first treated his report as a non-security issue. Android Authority says it asked Google about the timeline but had no response when it published.
Who is left out
Google’s October 2026 bulletin lists Android 14, 15, 16, 16 QPR2 and 17 as its updated versions, not 12 or 13. Google’s latest distribution data puts Android 12 at 9.6% of active devices and Android 13 at 11.8%. Together that’s 21.4%, about one in five devices.
That figure is not the whole vulnerable share. The data counts OS versions, not patch levels. A phone on Android 14 or newer that hasn’t installed a recent update is exposed too.
Owners still on Android 12 or 13 remain exposed to a bug that can drop emergency calls, even though a fix exists. Every phone eventually lands in this gap when support ends, as we covered for the Galaxy A04s and the Pixel 6 and 6 Pro.
What to do now
- Check your phone’s security patch level in the Settings app.
- Install the newest system update your phone offers.
- Check again in November, when Android Authority and GrapheneOS expect the bulletin entry for this bug.
Pixel owners already have October’s Android 17 security patch. Given the timing dispute, don’t assume that patch includes this fix.
Sources: SMS of Death writeup, AOSP commit 735d967, Google’s Android distribution data, Android Authority
