Invisible SMS of Death Crashes Android Phone Service, Blocking Even Emergency Calls
Security researcher Mark Blaszczyk has demonstrated an attack that uses a specially crafted, invisible SMS message to crash the telephony service on Android devices. The exploit targets the handler for WAP push messages and triggers an unhandled exception, forcing the phone service to restart and terminating any active calls, including those to emergency services. No user interaction is required, and the malicious message does not appear in normal messaging threads. A series of roughly 20 such messages can render a device unusable for extended periods, with repeated delivery from the carrier potentially creating reboot loops that require a computer to escape. The flaw was reproduced on Google Pixel and Samsung Galaxy devices. A patch addressing the issue is included in the October 2026 security update for Android versions 14 through 17, leaving older unsupported devices exposed.
AntiMalwareOct 30, 2026Translated from Russian