Published: October 30, 2026 | Last updated: October 30, 2026
A specially crafted WAP Push message can crash Android’s telephony process, according to independent researcher Mark Blaszczyk.
A newly disclosed Android vulnerability dubbed “SMS of Death” has raised concerns about the reliability of essential phone services. A specially crafted WAP Push message can trigger a crash in Android’s telephony process without requiring the recipient to open a message, tap a link or interact with the device, according to the researcher who reported it.
The reported impact includes dropped active calls and temporary disruption to cellular services. The researcher also says emergency calls can be affected. The issue is a denial-of-service (DoS) vulnerability: the public technical disclosure does not demonstrate that an attacker can use it to steal data or take control of an Android phone.
Independent security researcher Mark Blaszczyk publicly disclosed the issue on October 29, 2026, after reporting it to Google’s Android and Devices Vulnerability Reward Program on May 5, 2026. His disclosure describes the affected Android component, his device testing and the timeline of his communication with Google. Read Mark Blaszczyk’s original technical disclosure for his account of the vulnerability, testing and disclosure timeline.
What Is SMS of Death?
SMS of Death is the name used by researcher Mark Blaszczyk for a zero-click Android denial-of-service vulnerability involving the processing of WAP Push messages. It is not an official Android feature, a separate messaging app or the name of a conventional SMS phishing campaign.
The issue affects WapPushOverSms, a component in Android’s telephony framework that processes Wireless Application Protocol (WAP) Push messages. These are specially formatted data messages delivered through the mobile network. Android can process them automatically, without displaying them like an ordinary text message.
In the vulnerable code path described by the researcher, Android reads a WAP Push header-length value, converts it to an integer and uses that value when allocating an array. The researcher says an unchecked conversion can produce a negative array size. That triggers a NegativeArraySizeException and can terminate the com.android.phone process, which handles important telephony functions.
The key point is that the attack targets message processing inside the operating system. It does not depend on tricking someone into opening a link or installing an application.
How Does the Attack Work?
The reported attack follows a sequence:
- An attacker sends a specially crafted WAP Push data message to a target phone.
- Android automatically passes the message to its WAP Push processing component.
- A malformed length value reaches the vulnerable code path.
- The invalid value can trigger a NegativeArraySizeException.
- The com.android.phone process crashes, potentially interrupting calls and mobile services while the process restarts.
The researcher says the message may not appear in the normal messaging inbox, meaning the recipient may not see a familiar text notification or the sender’s number.
Can one message cause repeated disruption?
Blaszczyk reports that carrier redelivery of an unacknowledged message can trigger further crashes. He also describes more severe test scenarios involving repeated messages and possible corruption of the SMS database. These are claims from the researcher’s own testing and should not be presented as evidence of widespread exploitation in the wild.
The public disclosure does not establish that this vulnerability is being actively exploited at scale, nor does it identify a threat group using it.
What Happens When a Phone Receives It?
If a vulnerable device processes the crafted message and the reported crash occurs, users may experience:
- An active phone call disconnecting.
- Temporary inability to make or receive calls while telephony services restart.
- A short period of lost cellular connectivity.
- Delays or failures involving SMS while the phone’s messaging and telephony components recover.
- Repeated service interruptions if the message is delivered again.
The researcher says emergency calls can also be interrupted. This is an important potential safety impact, but it should be attributed to his testing rather than described as a confirmed, widespread incident affecting emergency services.
Blaszczyk also reports that rapid repeated delivery can cause SMS database corruption in some test scenarios. That is a more severe claim than a temporary process crash, so it should remain clearly attributed to the researcher.
Which Android Phones Are Affected?
The vulnerability is associated with Android’s telephony framework rather than a single phone brand. In his disclosure, Blaszczyk reports reproducing the issue on a Google Pixel 9 running April 2026 firmware and on multiple Samsung Galaxy devices, including Galaxy A-series models.
Those tests do not establish that every Pixel or Samsung phone is affected. Nor do they provide a complete list of vulnerable models.
The researcher’s technical write-up discusses code present across multiple Android versions. However, the exact exposure of an individual phone depends on its software build, manufacturer changes and whether the relevant mitigation has been incorporated. It would be misleading to label every device running Android 12 through Android 17 as currently vulnerable without a model- and build-specific assessment.
Users should therefore check their device’s security update status and the manufacturer’s security advisories rather than relying on the Android version number or brand alone.
Google’s Response and the Android Code Change
Blaszczyk says he reported the vulnerability to Google’s Android and Devices Vulnerability Reward Program on May 5, 2026. According to his disclosure, Google ultimately classified the report as a non-security issue and closed it on October 29, 2026. This account of Google’s triage decision comes from the researcher; Google’s issue-tracker discussion is not publicly readable.
There is also a relevant public change in the Android Open Source Project. A commit titled “Fix remote DoS in decodeWapPdu”, authored on June 15, 2026 and merged on August 5, 2026, changes exception handling during WAP Push decoding and SMS broadcast. The commit says it catches runtime exceptions, logs a warning and deletes the problematic message tracker from the raw database to help prevent persistent crash loops. See the AOSP code change: Fix remote DoS in decodeWapPdu for the actual code changes and accompanying tests.
This distinction matters. The public commit documents a mitigation for runtime exceptions and repeated crash loops. It should not be described as proof that Google accepted Blaszczyk’s report as a security vulnerability, nor as proof that every device received the mitigation. Device makers must integrate relevant Android changes into their own software releases.
Google’s October 2026 Android Security Bulletin says security patch levels of 2026-10-01 or higher address the vulnerabilities listed in that bulletin. The bulletin does not name “SMS of Death” or explicitly identify Blaszczyk’s disclosure. Do not assume that the bulletin alone confirms that every handset has received this specific mitigation.
How to Protect Your Android Phone
Because the reported issue involves automatic message processing, simply avoiding suspicious links or blocking unknown senders is not a dependable fix. The practical step is to keep the phone’s operating system and manufacturer firmware up to date.
1. Install available system updates
Open Settings and look for System update or Software update. The menu wording differs by manufacturer. On many Samsung phones, the path is Settings → Software update → Download and install. Install available updates from the device manufacturer.
2. Check the security patch level
Open Settings → About phone → Android version, then look for Android security update. The exact menu path varies. Compare the installed patch level with the manufacturer’s security guidance for your specific model.
3. Keep the device on supported firmware
Older phones that no longer receive security updates may not receive newer mitigations. Check the manufacturer’s support page to see whether your model remains eligible for updates.
4. Do not rely on Play Protect as the fix
Google Play Protect helps detect potentially harmful applications. It is useful, but it is not a direct repair for a flaw in Android’s WAP Push message-processing code. A relevant system or firmware update is the important mitigation.
5. Seek help if telephony keeps crashing
If calling services repeatedly stop working, check for updates and contact the phone manufacturer or mobile carrier. Do not assume every dropped call is caused by this vulnerability; network faults, SIM problems and unrelated software bugs can cause similar symptoms.
Should Android Users Be Worried?
Android users should take the disclosure seriously, but there is no reason to assume that every phone is exposed or that devices are being widely attacked. The researcher’s tests show a potential way to disrupt telephony services on the devices he examined. Public reporting available at the time of writing does not establish widespread exploitation in the wild.
The main concern is availability: a successful attack may interrupt ordinary calls and, according to the researcher, emergency calls. That makes the issue more consequential than a nuisance message. At the same time, the disclosed behaviour is a denial-of-service issue, not proof of remote access to photos, private conversations, passwords or banking applications.
The risk to an individual phone depends on its exact firmware and the availability of the relevant mitigation. Keep the device updated, follow the manufacturer’s security notices and avoid treating an Android version number as a guarantee of protection.
Frequently Asked Questions About SMS of Death
What is SMS of Death on Android?
It is the name given by researcher Mark Blaszczyk to a zero-click denial-of-service vulnerability involving Android’s WAP Push message processing. A crafted message can crash the telephony process on a vulnerable build.
Can SMS of Death hack an Android phone?
The disclosed impact is denial of service. The public report does not demonstrate that the flaw lets an attacker read personal files, steal passwords or take full control of a phone.
Does the attack require clicking a link?
No. The reported attack relies on Android automatically processing a specially crafted WAP Push message. The recipient does not need to tap a link or open a message.
Can a normal text message trigger the vulnerability?
The disclosure concerns a specially crafted WAP Push data message, not an ordinary conversational SMS.
Which Android phones were tested?
The researcher reports testing a Pixel 9 with April 2026 firmware and multiple Samsung Galaxy devices, including Galaxy A-series models. This is not a complete list of affected phones.
Which Android versions are affected?
The researcher discusses vulnerable code across multiple Android versions. Exact exposure depends on the device build, manufacturer changes and installed mitigations; a blanket version range should not be treated as a definitive list of currently vulnerable devices.
Can it interrupt emergency calls?
The researcher says his testing showed that emergency calls could be interrupted. This is a reported test result, not evidence of widespread real-world emergency-call disruption.
Does blocking unknown numbers stop the attack?
Blocking unknown senders is not a reliable mitigation because the issue involves automatic WAP Push processing.
Has Google fixed SMS of Death?
A public AOSP commit adds runtime-exception handling and deletion of problematic message records to help prevent persistent crash loops. Whether a particular phone includes the change depends on its firmware update.
How can I protect my Android phone?
Install updates from your phone manufacturer, check the security patch level and keep the device on supported firmware. Play Protect is useful for app safety but is not a substitute for a system fix.
Can SMS of Death permanently damage a phone?
The researcher reports severe repeated-crash scenarios and possible SMS database corruption in testing. The disclosure does not establish permanent hardware damage.
Should I stop receiving SMS messages?
No. There is no need to stop receiving ordinary SMS messages. Keep your device updated and follow manufacturer security guidance.
Final Thoughts: SMS of Death Highlights the Importance of Android Security Updates
The SMS of Death disclosure highlights how a weakness in the processing of a specialised mobile message can affect a phone’s most basic function: communication. The reported zero-click behaviour and potential interruption of emergency calls make the issue worth attention, even though the public evidence does not show widespread exploitation.
Independent researcher Mark Blaszczyk deserves credit for identifying the behaviour, reporting it to Google’s Android and Devices Vulnerability Reward Program, testing it across devices and publishing the technical details after his disclosure process. His account of Google’s triage decision should remain attributed to him, while the AOSP commit should be described separately as a documented code-level mitigation.
For Android users, the practical advice is straightforward: install available manufacturer updates, check the security patch level and keep using a supported device. The exact protection available depends on the handset’s firmware, so users should consult their manufacturer rather than assume that one Android version label guarantees safety.
Researcher Credit and Sources
Researcher credit: Mark Blaszczyk (public disclosure signed “Mark B”), an independent security researcher. The public disclosure identifies him as independent and documents his report to Google on May 5, 2026, followed by public disclosure on October 29, 2026. The sources reviewed for this article do not establish his nationality, place of residence or professional employer; these details have therefore not been inferred or invented.
Primary Sources
- Mark Blaszczyk’s original SMS of Death disclosure
- Android Open Source Project: Fix remote DoS in decodeWapPdu
Author:
Rajkumar R is a technology blogger, content creator, digital marketer, SEO specialist, and educator. He writes about emerging technologies, Android, cybersecurity, software, and digital trends. Through ProDigitalWeb, he aims to explain complex technology topics in clear, practical language and help readers make informed decisions about the technology they use.
