A safety researcher has uncovered a severe vulnerability in Android that permits an attacker to remotely crash a smartphone utilizing a specifically crafted textual content message. Dubbed “SMS of Dying,” the flaw can disrupt mobile providers, disconnect ongoing calls, and even depart a telephone caught in a reboot loop. The troubling half is that the recipient doesn’t should work together with it in any respect.
The flaw, tracked as CVE-2026-58882, was found by safety researcher Mark Blaszczyk, who first notified Google about it in Might. On October 29, he revealed his findings alongside a working demonstration, after efficiently reproducing the assault on Google Pixel and Samsung Galaxy smartphones. Google has already developed a repair, however its availability throughout Android units is one other matter.
Ought to each Android person be frightened?
The pool of affected units shouldn’t be restricted to a specific Android model, as what issues right here is the model of Android working on the telephone and whether or not it has acquired the mandatory safety patch. Blaszczyk says the repair has already reached Android 14 by 17 as a part of Google’s October 2026 safety updates. Nevertheless, the corporate didn’t point out the vulnerability in its October safety bulletin.
The researcher emphasised that older Android telephones working Android 12 and 13 haven’t acquired the repair, which leaves these with out ongoing safety assist uncovered to the assault. For everybody else, checking the safety patch stage and putting in the newest obtainable Android replace is the perfect precaution. The knowledge can often be discovered within the Settings menu, though the precise location differs relying on the producer.
It’s additionally price clarifying that it is a denial-of-service vulnerability, and never an exploit designed to steal passwords or private info. Up to now, there is no such thing as a confirmed proof of widespread assaults concentrating on Android customers.
How can a textual content message crash an Android telephone?
The difficulty at coronary heart is how Android processes WAP Push messages, that are dealt with by the working system with out showing within the common SMS inbox. Ordinarily, the person doesn’t should do something with these messages. However Blaszczyk discovered {that a} malformed message can set off an error in Android’s telephony framework, bringing down the method accountable for mobile connectivity.
On this case, the crash can disconnect an ongoing telephone name, together with one made to emergency providers. Furthermore, if the service makes an attempt to ship the identical message once more, the telephone can find yourself crashing repeatedly. Throughout testing, round 20 malicious messages had been sufficient to go away a smartphone caught in a reboot loop.
A manufacturing unit reset isn’t the one technique to get better the system. Nevertheless, the choice entails utilizing Android Debug Bridge (ADB) to clear the offending messages, which isn’t one thing a median smartphone person can be acquainted with.
RELATED COVERAGE:
