A single hidden text message can crash the phone process on Android and drop active calls, including emergency calls, without the person holding the phone touching anything. Security researcher Mark B published the Android SMS of Death write-up on October 29, 2026, and says Google’s fix shipped in the October update for Android 14 through 17.
Phones on Android 12 and 13 run the same code and are not covered. A call that dies with a two second signal blip usually gets blamed on the carrier, and this bug produces that exact symptom on demand.
TL;DR: A malformed WAP Push text crashes the telephony process on Android 12 through 17, dropping calls and cutting service for a second or two per message. Google’s October 2026 update fixes it on Android 14 through 17. Android 12 and 13 get no fix, so those phones stay exposed. Check your security update date and install the latest patch.
How the Android SMS of Death works
According to the researcher’s write-up, the flaw sits in WapPushOverSms, the part of Android’s telephony code that decodes WAP Push messages. A malformed message makes the code read a header length as a large number, then cast it to a smaller integer without a range check, which produces a negative array size and an uncaught exception.
That exception kills com.android.phone, the process that handles calls and cellular service. The message arrives as a data SMS, so nothing appears in Messages and the sender’s number is never shown.
Each message costs roughly one to two seconds without service, and active calls end as the process restarts. Carriers resend messages the phone never acknowledged, which is why the write-up reports intermittent outages lasting up to a week from a single message in testing. About 20 queued messages can leave a phone unusable for an extended stretch.
The researcher reports a 100% reproduction rate on a Pixel 9 running April 2026 firmware and on several Samsung Galaxy and A-series models. Whether your phone is exposed comes down almost entirely to its patch date.
Which Android versions get the October fix
The write-up says Android 12 through 17 are affected, based on reproduction from Android 12 to 16, and that Google’s fix covers Android 14 through 17. Google’s October 2026 Android Security Bulletin, published October 5, lists patch level 2026-10-01 for those versions.
| Android version | Affected, per the researcher | Fixed in October 2026 update |
|---|---|---|
| Android 12 | Yes | No |
| Android 13 | Yes | No |
| Android 14 through 17 | Yes | Yes, at patch level 2026-10-01 or later |
The bulletin does not name this specific bug, so the CVE that maps to it is not confirmed here. Pixel owners can compare their own patch date against the Pixel update tracker, while Samsung and carrier rollout dates for this particular fix have not been confirmed.
For most people, the SMS of Death bug will stay invisible until the day a call drops at the wrong moment. Google’s chosen fix is also not the one the researcher asked for.
What Google changed in the fix
Google’s commit 735d967, titled “Fix remote DoS in decodeWapPdu” and authored June 15, 2026, wraps the WAP Push decoding in a catch for RuntimeException. When decoding fails, the code logs a warning and deletes the bad message from the raw queue, so it stops replaying on every boot. The commit is marked as a CVE fix.
Mark B had proposed a range check before the cast instead, according to the write-up. The write-up reports the bug went to Google’s Android and Devices VRP on May 5, 2026, and was disclosed publicly only after the patch shipped.
Google’s catch-based fix is practical, though it leaves the unchecked cast itself in place. The write-up includes no Google explanation for choosing the catch over the range check.
What to do if your phone is on an older patch
Install the October 2026 security update or later, then confirm the Android security update date under Settings, About phone, Android version. The write-up states that devices on earlier patch levels remain vulnerable.
Android 12 and 13 phones are the harder case, because the researcher says no fix is provided for them. If one of those is your daily phone, the longer term answer is a device that still receives security updates.
A phone already stuck in a crash loop has a rougher road. The write-up credits a contributor, @sakisdog, with an ADB method that clears the poison messages without a factory reset, and it warns against choosing the wipe data option at the recovery prompt. It needs a computer and some patience, so it is not a casual repair.
Mark B has also published a working proof of concept under the Apache 2.0 license, with a warning to run it only against devices you own or are authorized to test. That makes updating sooner a better plan than waiting.
