This Android ‘SMS of Dying’ bug can crash telephones remotely

Think about dialing 911, solely on your cellphone to abruptly drop the decision. You haven’t pressed something, your sign hasn’t disappeared, and there’s no apparent rationalization. Someplace within the background, nevertheless, a textual content message you by no means obtained has simply introduced your cellphone’s calling service to its knees.

That’s the scary state of affairs behind SMS of Dying, a newly disclosed Android vulnerability that lets attackers remotely disrupt telephones with out the sufferer lifting a finger.

Safety researcher Mark Blaszczyk found the flaw, which entails a specifically crafted textual content message that Android struggles to course of. In contrast to a traditional SMS, it by no means seems in your inbox, so that you gained’t see a suspicious notification or unfamiliar sender to warn you. As an alternative, the message crashes the system that handles cellphone calls, instantly disconnecting ongoing conversations, together with calls to emergency companies. However a dropped name is perhaps the least of your worries.

As a result of Android can maintain attempting to course of the identical malicious message, the crash can occur repeatedly. Blaszczyk says round 20 such messages can depart a cellphone virtually unusable, probably trapping it in a bootloop.

Even a manufacturing facility reset may not present lasting aid if the service resends the offending messages. Recovering with out wiping the cellphone could require connecting it to a pc and manually clearing the messages, which is hardly a sensible answer for the typical Android consumer.

The researcher efficiently reproduced the assault on Google Pixel and Samsung Galaxy gadgets. The weak code dates again to Android 12, however the danger is determined by whether or not a tool has obtained the repair. Older Android variations that now not obtain safety updates could stay uncovered.

Blaszczyk first alerted Google on Might 5, however says Google repeatedly dismissed his report as a non-security concern. Annoyed by the response, he publicly disclosed the vulnerability and launched a working demonstration on October 29. Besides Google had already been engaged on an answer.

In keeping with Android’s personal code data, the corporate developed a repair on June 15. As an alternative of letting the malicious message repeatedly crash the cellphone, the up to date software program handles the error and removes the troublesome message earlier than it may trigger additional injury. GrapheneOS later clarified on X that Google distributed the repair via safety previews in July, months earlier than the researcher’s public disclosure.

The vulnerability can also be tracked as CVE-2026-58882, carries a Vital severity score, and is outwardly slated for inclusion in November’s Android Safety Bulletin.

So why was Google apparently dismissing an issue its engineers had already mounted? An inside communication breakdown might be responsible, presumably involving a reproduction report, although Google hasn’t publicly defined the discrepancy.

In keeping with Blaszczyk, Google included the repair in October’s Android safety updates for variations 14 via 17. GrapheneOS, in the meantime, says the vulnerability is scheduled for November’s safety bulletin, having already obtained the underlying repair via Google’s July safety previews.

These timelines aren’t essentially at odds. Producers can obtain safety fixes earlier than they seem in a public bulletin, however the rollout to particular person gadgets stays unclear. For Android customers, the most secure transfer is to put in the most recent obtainable safety replace.

We’ve reached out to Google for clarification on the patch timeline and can replace this text if we hear again.