Android statue at Google in Mountain View. Photo: Marcin Wichary / Wikimedia Commons (CC BY 2.0)
A researcher has released working attack code for a flaw in Android that lets anyone who knows your number crash your phone with a single text message. Nicknamed the “SMS of Death”, the message never shows up in your inbox and needs no tap. It kills the part of Android that runs calls and mobile signal, ending whatever call is in progress, including a call to emergency services. Google has fixed it for current versions of Android, but older phones that have stopped receiving security updates will stay exposed.
For most people the question is simple: has your phone installed its latest security update? The bug sits in Android’s core telephony code, which every manufacturer ships, so it is not tied to one brand. The researcher, who publishes as Mark B, says the crash reproduced every time on a Google Pixel and on several Samsung Galaxy phones, including the cheaper A-series, that had not yet received the fix.
The attack abuses WAP Push, an old message format that carriers use to send settings to phones in the background. A malformed message makes Android try to reserve a negative amount of memory, and the process that manages calls and signal crashes. Each message costs the victim a second or two with no service. Repetition does the real damage. Carriers keep re-sending messages a phone never acknowledged, and in the researcher’s tests a single message caused on-and-off outages for up to a week. About 20 of them left a phone unusable.
The poisoned messages also stay queued and get processed again at every startup. One Android 12 phone in testing rebooted into recovery mode roughly every 90 seconds, a loop that an ordinary owner would escape only with a factory reset that wipes the device. A contributor to the project who goes by Sakis found a way to delete just the offending messages, but it needs a computer, Android’s developer tools and quick timing in the short window after each reboot.
The researcher, who frames the bug around Australia’s Triple Zero emergency number, points to an odd side effect there. Australian rules require carriers to find handsets that cannot reach emergency services and eventually cut them off, and Telstra says it blocks such phones if nothing changes within 28 days. In the researcher’s reading, an attacker who can make a phone fail emergency calls on demand could get the victim’s own handset barred from the network.
There are limits to the alarm. This is a denial-of-service attack, not a break-in: the message cannot read your data, install anything or take control of the phone. The attacker needs your number and a way to send raw data messages, and the published tool sends them from another Android phone with a SIM card, which leaves a record at the carrier. No public report so far describes the bug being used against real people. Google’s October security bulletin does not list the fix either, as BleepingComputer noted, so owners of older phones have had no official warning that they are exposed.
To check, open Settings, go to About phone or Security, and look at the Android security update date. Anything from October 2026 onward includes the fix. Samsung, Motorola, Xiaomi and other makers deliver patches on their own schedules, and carriers can hold them back, so a phone on a newer Android version may still be waiting. For phones stuck on Android 12 or 13, the only complete protection is moving to a device that still gets updates.
The researcher reported the flaw to Google’s Android vulnerability reward program on May 5. A Google engineer wrote the fix in mid-June, and it shipped in the October 2026 security update for Android 14 through 17. The public write-up and the proof-of-concept followed on October 29. Google did not add the length check the researcher had proposed: its patch catches the crash and deletes the offending message so it cannot fire again.
That leaves older Android phones in an odd state. They still make calls normally. They just cannot count on finishing one.
More Like This
Google gives Android developers until February to use less RAM
iPhone-to-Android texts will finally be encrypted in iOS 26.5
An AI wrote a working zero-day exploit
Chrome’s autofill used to stop at your address. Now it reads your Gmail
WhatsApp finally lets you chat without sharing your phone number
