Android's SMS of Death bug can knock out your phone, but a fix is coming soon

Imagine dialing 911, only for your phone to suddenly drop the call. You haven’t pressed anything, your signal hasn’t disappeared, and there’s no obvious explanation. Somewhere in the background, however, a text message you never received has just brought your phone’s calling service to its knees.

That’s the frightening scenario behind SMS of Death, a newly disclosed Android vulnerability that lets attackers remotely disrupt phones without the victim lifting a finger.

Security researcher Mark Blaszczyk discovered the flaw, which involves a specially crafted text message that Android struggles to process. Unlike a normal SMS, it never appears in your inbox, so you won’t see a suspicious notification or unfamiliar sender to warn you. Instead, the message crashes the system that handles phone calls, immediately disconnecting ongoing conversations, including calls to emergency services. But a dropped call might be the least of your worries.

Because Android can keep trying to process the same malicious message, the crash can happen repeatedly. Blaszczyk says around 20 such messages can leave a phone practically unusable, potentially trapping it in a bootloop.

Even a factory reset might not provide lasting relief if the carrier resends the offending messages. Recovering without wiping the phone may require connecting it to a computer and manually clearing the messages, which is hardly a realistic solution for the average Android user.

The researcher successfully reproduced the attack on Google Pixel and Samsung Galaxy devices. The vulnerable code dates back to Android 12, but the risk depends on whether a device has received the fix. Older Android versions that no longer receive security updates may remain exposed.

Google said it wasn’t a security issue. Its own fix suggests otherwise.

Blaszczyk first alerted Google on May 5, but says Google repeatedly dismissed his report as a non-security issue. Frustrated by the response, he publicly disclosed the vulnerability and released a working demonstration on October 29. Except Google had already been working on a solution.

According to Android’s own code records, the company developed a fix on June 15. Instead of letting the malicious message repeatedly crash the phone, the updated software handles the error and removes the troublesome message before it can cause further damage. GrapheneOS later clarified on X that Google distributed the fix through security previews in July, months before the researcher’s public disclosure.

The vulnerability is also tracked as CVE-2026-58882, carries a Critical severity rating, and is apparently slated for inclusion in November’s Android Security Bulletin.

So why was Google apparently dismissing a problem its engineers had already fixed? An internal communication breakdown could be to blame, possibly involving a duplicate report, though Google hasn’t publicly explained the discrepancy.

According to Blaszczyk, Google included the fix in October’s Android security updates for versions 14 through 17. GrapheneOS, meanwhile, says the vulnerability is scheduled for November’s security bulletin, having already received the underlying fix through Google’s July security previews.

Those timelines aren’t necessarily at odds. Manufacturers can receive security fixes before they appear in a public bulletin, but the rollout to individual devices remains unclear. For Android users, the safest move is to install the latest available security update.

We’ve reached out to Google for clarification on the patch timeline and will update this article if we hear back.