Late last week, a report popped up about a new Android phone exploit the security researcher dubbed "SMS of Death." Per the report, the attack, tracked as "CVE-2026-58882," lets malicious actors disrupt cellphone service or crash Android phones by overloading them with a repeating crafted SMS text message.

The denial-of-service flaw can even interrupt ongoing calls, including emergency calls, without requiring you to open the message. Apparently, the Android operating system processes the message before it even reaches your text message inbox, meaning you wouldn't immediately understand what caused the phone to crash.

Researcher Mark Blah says that even if you reboot your phone, the hacked message "stays queued and is retried on every boot, so the phone can crash on startup until it is cleared (recovery below)."

Upon finding Blah's report, Tom's Guide reached out to Google because the report claimed that Google had deemed it a "non-priority." Google has not yet responded to our inquiries.

Blah's report found that the exploit affects Android versions 12 up to 16 and was discovered on multiple devices, including Pixel 9s and Samsung Galaxy phones.

It appears Google patched the exploit in the October 2026 Android security update (if you haven't updated your Android phone, you should). However, that's only for Android versions 14 through 17. It does not appear to be available for any devices still running Android 12 or 13.

decodeWapPdu function. Attacks send a malformed WAP Push message to the targeted phone.

Source link