Android SMS of Death Vulnerability Discovered: What We Know About the Crash Bug and Coming Fixes

A newly disclosed Android vulnerability known as the "SMS of Death" allows specially crafted text messages to silently crash a phone’s calling service and potentially cause reboot loops. Security researcher Mark Blaszczyk discovered the bug, which affects devices running older vulnerable code dating back to Android 12.

According to reported details, the malicious messages do not appear in a user's inbox, meaning there is no visual warning. Instead, the input causes the system handling phone calls to fail, potentially disconnecting active conversations, including emergency calls. Repeated transmission of these messages can trigger persistent crashes or bootloops, requiring technical intervention to recover the device.

Discovery, Timeline, and Google's Response

• Discovery: Researcher Mark Blaszczyk reported the flaw to Google on May 5, though he stated the initial reports were dismissed as non-security issues.
• Public Disclosure: Frustrated by the initial handling, Blaszczyk publicly disclosed the vulnerability and a working demonstration on October 29.
• Fix Development: Code records indicate Google developed a fix on June 15, and GrapheneOS noted that the fix was distributed in security previews in July.
• Current Status: The issue is tracked as CVE-2026-58882 with a Critical severity rating and is reportedly slated for the November Android Security Bulletin, with some versions receiving updates in October.

Practical Implications and How to Verify

While Google engineers independently developed a fix months before the public disclosure, rollout timelines across different manufacturers and carrier networks can vary. Older Android devices that no longer receive official security updates may remain exposed to the vulnerability.

• Verification: Users should check their device's security patch level by navigating to Settings > About Phone > Android Version > Android Security Update.
• Protection: Installing the latest available security updates provided by your device manufacturer or carrier is the recommended method to ensure protection against known flaws.

Readers should verify original announcements directly through official Google security bulletins and manufacturer support channels.