A specially crafted WAP Push message can reportedly disrupt calls on Android phones without the recipient tapping a link, installing an app or even seeing the message in their inbox. Security researcher Mark Blaszczyk has disclosed the issue, dubbed “SMS of Death,” saying it can crash the system service responsible for telephony and temporarily cut mobile connectivity, including emergency-call capability.
Blaszczyk says he reproduced the flaw on Google Pixel and Samsung Galaxy phones running Android 12 through Android 16. The malformed message is processed automatically in the background, where a decoding error can terminate the telephony service before the message reaches the conventional SMS interface.
The more serious scenario arises if the messages remain in the processing queue or are resent. According to the researcher, about 20 messages can leave a device unusable for an extended period: after a restart, the phone attempts to process the same entries again and repeats the crash. The reported attack is intended to deny normal phone operation rather than steal personal data. Recovery may require connecting the device to a computer and using Android Debug Bridge (ADB), a process that is unlikely to be straightforward for non-technical users.
Patch status depends on Android version and device support
Android code now includes handling for decoding errors that removes the problematic entry from the internal queue, preventing the recurring crash cycle. Android’s public code record indicates that work on the fix was dated June 15, 2026, while Blaszczyk says he reported the issue to Google on May 5, ahead of its public disclosure on October 29.
- Android 12: Blaszczyk identifies this version as not receiving the correction.
- Android 13: Blaszczyk identifies this version as not receiving the correction.
- Android 14 through Android 17: The fix is reported to be included in October 2026 updates, subject to each manufacturer’s rollout and support policy.
There is no simple setting in a messaging app to block this attack because the WAP Push payload is processed before it appears in the inbox. Installing the latest software package available for a device—ideally one carrying the October 2026 security patch or a later release that includes the fix—is the available protection, while patch delivery for individual models remains dependent on their manufacturers.
