Google Fixes Android SMS of Death Zero-Click Vulnerability
Google released a security patch for a zero-click Android vulnerability that allows attackers to crash phones and trigger reboot loops via specially crafted SMS messages.
Security researcher Mark Blaszczyk disclosed a critical zero-click vulnerability in Android, tracked as CVE-2026-58882 and dubbed the SMS of Death. The flaw allows attackers to remotely crash smartphones by sending malformed WAP Push SMS messages that trigger a NegativeArraySizeException in the telephony framework. Because the system processes these messages in the background, the attack requires no user interaction.
A single message can disconnect active calls, including emergency services, and interrupt cellular connectivity. Repeated attacks or carrier redeliveries can trap devices in persistent reboot loops, rendering them unusable. Recovery from such a state requires either a factory reset, which erases all data, or the use of Android Debug Bridge to clear the messages.
Blaszczyk reported the flaw to Google on May 5, 2026, but the company initially closed the report as Will Not Fix. GrapheneOS later suggested this was likely an internal miscommunication. Google eventually developed a fix in June 2026, which was included in October security updates for devices running Android 14 through 17. However, Google did not list the vulnerability in its October security bulletin.
Devices running Android 12 and 13 remain exposed because Google no longer supports those versions, leaving users dependent on individual manufacturers for patches. GrapheneOS implemented its own fix for the vulnerability in July.
