Stephen Radochia
Add Android Authority on Google:
Summary:
- A recently uncovered Android vulnerability can allow harmful text messages to disrupt a phone’s calling services, potentially hindering emergency calls.
- Repeated instances of this exploit can lead to endless crashes and reboot loops, making device recovery difficult without technical assistance.
- Google developed a remedy months before the issue was made public, but it remains uncertain when it will be available to users.
Picture this: you attempt to call emergency services, but your call is disconnected without any interaction from you. There’s no loss of signal or other obvious explanations. Behind the scenes, a text message that never reached you is causing your phone’s call service to malfunction.
This alarming situation is known as the “SMS of Death,” a newly revealed Android vulnerability that allows cyber attackers to remotely incapacitate smartphones without any action from the user.
Because Android attempts to process the malicious message repeatedly, this can result in multiple crashes. Blaszczyk mentions that around 20 such messages can effectively render a phone almost unusable, putting it in a bootloop.
A factory reset might not offer a permanent fix, particularly if the carrier retransmits the harmful messages. To recover without wiping the device may require connecting it to a computer to manually delete the messages—this is a complicated task for the average Android user.
The researcher managed to replicate this attack on Google Pixel and Samsung Galaxy devices. The problematic code has been present since Android 12, but the risk varies depending on whether a device has received an update. Older versions of Android that no longer receive updates may still be vulnerable.
Google maintains it isn’t a security issue, despite its own solution.
Taylor Kerns
Blaszczyk first informed Google of the issue on May 5, only to have the company repeatedly classify his report as a non-security concern. Frustrated by their response, he made the vulnerability public and demonstrated it on October 29. However, Google had already been addressing the issue.
According to records, Google created a fix as early as June 15. The updated software prevents the malicious message from causing repeat crashes, identifying and removing it before it can do harm. Clarification from GrapheneOS indicates that Google distributed this fix through security previews in July, well ahead of the public notice.
This vulnerability, identified as CVE-2026-58882, has a critical severity rating and is expected to feature in November’s Android Security Update.
So, why did Google downplay a concern that its engineers had already resolved? An internal miscommunication might be at fault, potentially due to duplicate reports; nevertheless, Google hasn’t provided a public explanation for this inconsistency.
Blaszczyk indicated that Google incorporated the fix into the Android security updates for versions 14 through 17 in October. Meanwhile, GrapheneOS has noted that the vulnerability is scheduled for discussion in November’s security updates, having earlier received the necessary fix in July.
These timelines are not necessarily contradictory. Manufacturers can receive security updates before they’re made public, but device rollout schedules aren’t always clear. For users of Android, the best course of action is to ensure they install the most recent available security updates.
We have reached out to Google for more information on the patch timeline and will provide updates as we get additional information.
