Tech News: A major security warning has emerged for Android smartphone users. A serious security vulnerability, dubbed the “SMS of Death,” has been discovered, which could allow cybercriminals to crash critical phone services by sending a specially crafted SMS. Alarmingly, this attack does not require the user to open the message or click on any links. Google has released a security fix to address this flaw; however, Android users are advised to remain vigilant regarding their device’s security.
What is the “SMS of Death” security vulnerability?
The “SMS of Death” is a “zero-click” security vulnerability. This means that cybercriminals do not need to wait for any user action—such as opening a message or clicking a link—to launch an attack. A specially crafted SMS can trigger a system malfunction the moment it arrives on the device.
According to reports, security researcher Mark Blaszczyk notified Google about this vulnerability on May 5, 2026. Technical details regarding the flaw were subsequently made public on October 29.
How could a single SMS crash a phone?
This vulnerability was linked to the WAP Push message processing system within Android’s telecom framework. A flaw in the process used to verify data length meant that the system could crash when handling a specially crafted message.
The issue affected a critical system process known as com.android.phone, which manages calling and mobile network-related functions. A crash in this process could result in dropped calls and the temporary disruption of mobile network services. Furthermore, it posed a risk to emergency calling capabilities.
Devices tested
During the research, this vulnerability was tested on several devices, including the Google Pixel 9 and various smartphones from the Samsung Galaxy series. According to the report, the vulnerable code had been present since Android 12. Another serious aspect of this security vulnerability was that the malicious message would not appear in the standard SMS inbox. Consequently, the user would not even be aware that a suspicious message had arrived on their phone.
During testing, repeatedly sending such messages caused the network service on some devices to be disrupted for extended periods. In some cases, it even became difficult to use the phone for its intended functions. However, these results were observed during controlled testing.
How did Google fix this issue?
This vulnerability has been registered under the identifier CVE-2026-58882. According to available information, Google addressed the issue on June 15, 2026, by implementing changes to the Android open-source code. Subsequently, the security fix was distributed to device manufacturers.
The purpose of this update is to ensure that the phone’s entire telecommunication system does not crash when processing a maliciously crafted WAP Push message.
What Android users should do immediately
If you use an Android smartphone, take the following precautions to keep your device secure:
Install the latest updates: Go to your phone’s ‘Settings’ and check for ‘Software Update’ or ‘System Update’ options.
Check for security patches: Verify whether a new security update is available for your smartphone.
Keep your phone updated: Users of devices from brands such as Samsung, Xiaomi, OnePlus, and Motorola should check for any updates released for their specific devices.
Do not ignore updates: Install security updates as soon as they become available.
