conv.

All stories
SecurityQuiet 9d · day 14

Android “SMS of Death” bug lets one invisible text crash calls

Researcher Mark Blaszczyk publishes a working exploit after saying Google dismissed his report for months; Google says a fix is already rolling out.

newest coverage 9d agosummary written 12d ago24 pieces1.4k likes & upvotes52 comments LobstersXMastodonNewswiresRedditGoogle News

What to know

  • An invisible, specially crafted SMS can repeatedly crash Android's calling service, including during emergency calls, without the victim seeing any message.
  • Around 20 such messages can leave a phone practically unusable or stuck in a bootloop, and even a factory reset may not fix it if the carrier resends the messages.
  • Google reportedly dismissed the researcher's May report as a non-security issue despite internally developing a fix by June 15 and distributing it via security previews in July.
  • The bug (CVE-2026-58882, Critical severity) is expected in the November Android Security Bulletin; affected devices include Pixel and Galaxy phones, with risk highest on devices no longer receiving security updates.

Mark Blaszczyk Security researcherGoogle Android vendorGrapheneOS Privacy-focused Android fork maintainer

Android “SMS of Death” bug lets one invisible text crash calls
x.com

How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts

Peak 9 pieces in 4h at Oct 31, 11 AM; 24 pieces over 14 days (11 articles · 13 posts) Oct 29, 3 AM — 1 piece · 1 post — Lobsters 1Oct 29, 7 AM — 1 piece · 1 post — X 1Oct 29, 11 AM — quietOct 29, 3 PM — quietOct 29, 7 PM — quietOct 29, 11 PM — 1 piece · 1 post — Mastodon 1Oct 30, 3 AM — 1 piece · 1 article — Newswires 1Oct 30, 7 AM — quietOct 30, 11 AM — quietOct 30, 3 PM — 1 piece · 1 post — Mastodon 1Oct 30, 7 PM — quietOct 30, 11 PM — quietOct 31, 3 AM — quietOct 31, 7 AM — 1 piece · 1 post — Mastodon 1Oct 31, 11 AM — 9 pieces · 8 articles · 1 post — Google News 8, Mastodon 1Oct 31, 3 PM — 2 pieces · 2 posts — Reddit 1, Mastodon 1Oct 31, 7 PM — 1 piece · 1 post — Mastodon 1Oct 31, 11 PM — quietNov 1, 2 AM — quietNov 1, 6 AM — quietNov 1, 10 AM — quietNov 1, 2 PM — quietNov 1, 6 PM — quietNov 1, 10 PM — quietNov 2, 2 AM — 2 pieces · 2 posts — Mastodon 2Nov 2, 6 AM — quietNov 2, 10 AM — 3 pieces · 1 article · 2 posts — Mastodon 2, Reddit 1Nov 2, 2 PM — 1 piece · 1 article — Newswires 1Nov 2, 6 PM — quietNov 2, 10 PM — quietNov 3, 2 AM — quietNov 3, 6 AM — quietNov 3, 10 AM — quietNov 3, 2 PM — quietNov 3, 6 PM — quietNov 3, 10 PM — quietNov 4, 2 AM — quietNov 4, 6 AM — quietNov 4, 10 AM — quietNov 4, 2 PM — quietNov 4, 6 PM — quietNov 4, 10 PM — quietNov 5, 2 AM — quietNov 5, 6 AM — quietNov 5, 10 AM — quietNov 5, 2 PM — quietNov 5, 6 PM — quietNov 5, 10 PM — quietNov 6, 2 AM — quietNov 6, 6 AM — quietNov 6, 10 AM — quietNov 6, 2 PM — quietNov 6, 6 PM — quietNov 6, 10 PM — quietNov 7, 2 AM — quietNov 7, 6 AM — quietNov 7, 10 AM — quietNov 7, 2 PM — quietNov 7, 6 PM — quietNov 7, 10 PM — quietNov 8, 2 AM — quietNov 8, 6 AM — quietNov 8, 10 AM — quietNov 8, 2 PM — quietNov 8, 6 PM — quietNov 8, 10 PM — quietNov 9, 2 AM — quietNov 9, 6 AM — quietNov 9, 10 AM — quietNov 9, 2 PM — quietNov 9, 6 PM — quietNov 9, 10 PM — quietNov 10, 2 AM — quietNov 10, 6 AM — quietNov 10, 10 AM — quietNov 10, 2 PM — quietNov 10, 6 PM — quietNov 10, 10 PM — quietYesterday, 2 AM — quietYesterday, 6 AM — quietYesterday, 10 AM — quietYesterday, 2 PM — quietYesterday, 6 PM — quietYesterday, 10 PM — quiet 12
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9Nov 10now · 12:10 AM ET
  1. 2

    Fix timeline and severity details surface

    Coverage clarifies the flaw is tracked as CVE-2026-58882 with Critical severity, was reportedly included in October security updates for Android 14-17 per Blaszczyk, and is slated for the November Android Security Bulletin per GrapheneOS; Google has not explained the internal discrepancy.

    • ai6yr@m.ai6yr.org

      oh yay ""SMS of Death" and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message. The zero-click denial-of-service flaw can interrupt ongoing calls, including emergency calls, without requiring any interaction from the target. What's worse, Android processes the…

      ai6yr@m.ai6yr.orgMastodon11d ago11▲view on Mastodon ↗
    2 more of the top 3 · 7 posts in this stretch
    • paul@oldfriends.live

      Wow. Crash Android phone with a SMS text? A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message. # Android https://www…

      paul@oldfriends.liveMastodon11d ago6▲view on Mastodon ↗
    • bontchev@infosec.exchange

      "‘SMS of Death’ flaw cuts off Android calls without user interaction": https:// cyberinsider.com/android-sms-t elephony-crash-vulnerability/

      bontchev@infosec.exchangeMastodon12d ago1▲view on Mastodon ↗
    all of them →
  2. 1

    Blaszczyk publicly discloses the bug and releases a PoC

    Frustrated by Google's dismissal of his report, Blaszczyk published the vulnerability and a working demonstration showing an invisible SMS can repeatedly crash a phone's calling service, dropping active and emergency calls.

    “Google won't fix an Android bug that lets one invisible text crash a phone's calling service, researcher Mark Blaszczyk says. So he just released the Proof-of-Concept!”
    — @IntCyberDigest

    • ‼️ Google won't fix an Android bug that lets one invisible text crash a phone's calling service, researcher Mark Blaszczyk says. So he just released the Proof-of-Concept! The malformed message never reaches the inbox and needs no user interaction. It drops active calls,

      @IntCyberDigestX13d ago1.3k▲view on X ↗
  3. background

    Google distributes the fix via security previews — GrapheneOS clarified on X that Google had already pushed the fix out through security previews in July, months before the researcher's public disclosure.

  4. background

    Google quietly develops an internal fix — According to Android's own code records, Google developed a fix on June 15 that handles the malformed message error and removes it before it can crash the phone repeatedly.

  5. background

    Blaszczyk reports the flaw to Google — Security researcher Mark Blaszczyk first alerted Google to the vulnerability, but says Google repeatedly dismissed his report as a non-security issue.

Also covered reported alongside — the timeline has no entry for these yet

  1. 4 outlets This Android SMS Of Death Attack Crashes Phones Without A Single Tap

    first by HotHardware, 11d ago · also Digital Trends, BleepingComputer, Tom's Guide

    3 more headlines
  2. 1 outlet Android's SMS of Death bug can knock out your phone, but a fix is coming soon

    first by Android Authority, 11d ago

    1 more headline

and 3 smaller pieces

What people are saying 4 voices from 1 site · best of 8 · verbatim