A security researcher has discovered a serious vulnerability in Android that allows an attacker to remotely crash a smartphone using a specially crafted SMS. Dubbed the “text of death,” the bug can disrupt cellular services, disconnect ongoing calls, and even leave a phone stuck in a restart loop. The disturbing part is that the recipient doesn’t have to interact with it at all.
The flaw, tracked as CVE-2026-58882, was discovered by security researcher Mark Blaszczyk, who first notified Google in May. On October 29, he published his findings alongside a work demonstration, after successfully reproducing the attack on Google Pixel and Samsung Galaxy smartphones. Google has already developed a fix, but its availability on Android devices is another matter.
Should all Android users be concerned?
The pool of affected devices is not limited to a particular Android brand, because what matters here is the version of Android running on the phone and whether it has received the necessary security patch. Blaszczyk says the fix has already reached Android 14 to 17 as part of Google’s October 2026 security updates. However, the company did not mention the vulnerability in its October security bulletin.
The researcher pointed out that older Android phones running Android 12 and 13 did not receive the fix, leaving those without ongoing security support exposed to the attack. For everyone else, checking the security patch level and installing the latest available Android update is the best precaution. The information can usually be found in the settings menu, although the exact location differs depending on the manufacturer.
It’s also worth clarifying that this is a denial-of-service vulnerability, and not an exploit designed to steal passwords or personal information. So far, there is no confirmed evidence of widespread attacks targeting Android users.
How can an SMS crash an Android phone?
The issue at heart is how Android processes WAP push messages that are handled by the operating system without appearing in the regular SMS inbox. Normally the user does not have to do anything with these messages. But Blaszczyk found that a malformed message can trigger an error in the Android telephony framework, bringing down the process responsible for cellular connectivity.
In this case, the crash can interrupt an ongoing call, including one made to the emergency services. Furthermore, if the carrier tries to deliver the same message again, the phone may hang up again and again. During the test, about 20 malicious messages were enough to keep a smartphone in a restart loop.
A factory reset is not the only way to recover the device. However, the alternative involves using Android Debug Bridge (ADB) to remove the offending messages, which is not something an average smartphone user would be familiar with.
RELATED COVERAGE: