Security researcher Mark Blaszczyk has and discovered critical vulnerability affects Android devices running Android 12 or newer worldwide. Replicating a modern variation of the classic “SMS of Death,” the exploit allows malicious actors to remotely disable network signals and crash smartphones by transmitting silent, background WAP push messages.
The attack vector works by bypassing the default notification inbox. The incoming SMS is completely in the background Android telephony framework without alerting the device owner. Once executed, the flaw immediately disrupts core cellular services, disconnects active phone calls – including emergency calls – and results in the temporary loss of mobile network connectivity.
The vulnerability affects Pixel and Galaxy devices running Android 12 or newer
Furthermore, if an attacker continuously transmits about 20 of these messages in quick succession, the device can infinite restart loop (bootloop). In severe cases, the exploit risks making the smartphone completely inoperable, a condition commonly known as “brick”. Recovering from this state is extremely complex, often requiring specialized technical assistance or connecting the phone to a computer to manually remove corrupt system files.
Testing has confirmed that the vulnerability affects popular consumer devices, incl Google Pixel and Samsung Galaxy Models. In response to the discovery, Google has developed a security patch that is included in the October and November security updates for devices with Android 14 and above. This updated firmware identifies the malicious payload and deletes it immediately before the telephony framework can process it. However, older smartphones using unpatched legacy Android versions remain fully exposed to the threat. Users are strongly advised to update their operating systems immediately to protect against potential network disruptions and device shutdowns.
Equipped and . Read more about Android and security.