Pull to refresh
Logo
What Changed
Following Why Sign Up
Google fixes zero-click Android SMS crash, but calls it non-security

Google fixes zero-click Android SMS crash, but calls it non-security

New Capabilities

Google's June fix reportedly shipped in October for Android 14 through 17, but Android 12 and 13 remain exposed and the bug is absent from the public bulletin

October 29th, 2026: Final Won't Fix and public disclosure

Overview

Updated Nov 2

Google reportedly shipped a fix for the Android 'SMS of Death' crash in its October 2026 security updates for Android 14 through 17, according to the researcher who found it. Reports now cite CVE-2026-58882 for the zero-click flaw, which lets one malformed text message crash the phone service and drop calls, including emergency calls.

Google classed the crash as non-security, and the fix is not listed in its public October security bulletin, so a phone's patch level alone does not show whether it has the fix. Android 12 and 13 phones did not receive it and remain exposed. About 20 malicious messages can push a device into a reboot loop, and a GitHub contributor named Sakis found a way to clear the messages using Android Debug Bridge.

Why it matters

A stranger can knock any Android user off the network with a text they never see, and older phones still have no patch.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

100%
Crash reproduction rate on tested handsets
Pixel 9 and Samsung Galaxy and A-series devices all crashed with a single message.
~30
Messages needed to corrupt the SMS database
Rapid delivery triggers SQLite corruption that crashes the phone on every boot.
177
Days from report to public disclosure
The disclosure came 87 days after the VRP's standard 90-day window closed.
4
Google engineers who reviewed the report
Reviewed across three tickets. Google's October 29 ruling classed the bug non-security.
~20
Messages that can trigger reboot loops
About 20 malicious messages can make a phone unusable; one Android 12 device rebooted to recovery roughly every 90 seconds.
CVE-2026-58882
CVE assigned
Reports cite the identifier; 0dayNews could not confirm a public NVD record on November 1.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

MB
Mark Blaszczyk
Independent security researcher
Published full disclosure and proof of concept on October 29, after Google's final non-security ruling that day

Organizations Involved

GA
Google Android Security Team
Corporate security division
Classed the crash as non-security but shipped a fix in October 2026 for Android 14-17

The group that runs Google's Android Vulnerability Reward Program and triages security reports.

Timeline

May 2026 October 2026

13 events Latest: October 29th, 2026 · 1 week ago Showing 8 of 13
Tap a bar to jump to that date

  1. Final Won't Fix and public disclosure

    Latest Disclosure

    Google issues final Won't Fix; researcher publishes full disclosure and proof of concept.

  2. Status update requested

    Request

    Researcher requests a status update after three months without response.

  3. Fix submitted to LineageOS

    Patch

    A cherry-picked copy of the fix is submitted to LineageOS's telephony framework repository.

  4. Fix reportedly ships for Android 14 through 17

    Patch

    The researcher says Google's June fix reached Android 14 through 17 in October 2026 security updates. The October bulletin does not list the bug.

  5. Report reopened, then marked duplicate

    Decision

    Google reopens the report after it surfaces on Discord, then confirms it as duplicate.

  6. Fix ships in GrapheneOS security previews

    Patch

    GrapheneOS says the fix went out in Android's security preview patches and in its own July security preview releases.

  7. Disclosure hold requested

    Request

    Google asks the researcher to hold disclosure under the 90-day VRP timeline.

  8. SQLite corruption reported

    Report

    Researcher reports rapid sends corrupt the SMS database, crashing the phone on boot.

  9. First Won't Fix decision

    Decision

    Google closes report as Won't Fix, saying it is not a security vulnerability.

  10. Appeal rejected in three minutes

    Appeal

    Resubmission is closed as not reproducible within three minutes.

  11. Google writes fix for WAP Push crash

    Patch

    A Google engineer commits a fix titled 'Fix remote DoS in decodeWapPdu.' It catches runtime exceptions and deletes the poisoned message instead of adding a bounds check.

  12. Priority request

    Appeal

    Researcher requests priority citing five-handset reproduction and emergency-call impact.

  13. Report filed with Google's VRP

    Report

    Blaszczyk files the report with a one-line bounds-check fix.

Scenarios

1

Google reverses course and patches WapPushOverSms

Possible Resolves by Q2 2027

Discussed by: Security researchers following the public disclosure

The disclosure could push Google to reverse its Won't Fix decision. The fix is a bounds check before the integer cast on line 217 of WapPushOverSms.java, which the researcher provided in the original report. A patch would ship in a future Android Security Bulletin.

2

Carriers filter WAP Push messages to blunt the attack

Possible Resolves by Q2 2027

Discussed by: The researcher's offer to brief Australian carriers before disclosure

Carriers can filter malformed WAP Push messages at the network level, preventing delivery to subscribers and neutralizing the attack without a device patch. Australian carriers are the most likely first movers because the bug interrupts access to Triple Zero, which the regulator treats as a mandatory service property.

3

Google holds Won't Fix and the flaw goes unpatched

Likely Resolves by Q2 2027

Discussed by: Google's final decision quoted in the disclosure

Google maintains its classification and ships no patch. The vulnerability stays exploitable on any Android device that accepts data SMS. Stock Android and older devices remain exposed while the disclosure circulates among attackers.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

July 2015

Stagefright (2015)

Zimperium researchers found remote code execution in Android's Stagefright media library. A single MMS could trigger it with no user action, affecting an estimated 950 million devices.

Then

Google released emergency patches, but carriers and OEMs took months to push them to phones.

Now

The episode pushed Google to create monthly Android security bulletins and press the industry toward faster updates.

Why this matters now

Like this WAP Push flaw, Stagefright was remotely triggerable through messaging with zero user interaction, and the fix depended on a fragmented update ecosystem.

May 2015

'Effective Power' iPhone text bomb (2015)

A specific text message with a malformed Unicode sequence crashed the Messages app and rebooted iPhones. The payload spread through social media and could hit any phone number.

Then

Apple released a fix for the original bug and another for a variant that resurfaced in 2018.

Now

The bug became the standard example of text-bomb denial-of-service attacks on mobile phones.

Why this matters now

The attack mechanism mirrors this one, but the vendor responses diverge: Apple patched both times, while Google classified this crash as a non-security issue.

Sources

(10)
+4
smsofdeath.com GitHub Zubiqo ki48.no Cyber Kendra BleepingComputer NEXSIGHT CYBER WIRE LineageOS Gerrit 0dayNews derStandard.at