Android flaw lets attackers trigger repeated remote phone crashes

A zero‑click Android flaw dubbed the SMS of Death affects millions of handsets by forcing telephony services into endless termination and recovery loops. Security researcher Mark Blah disclosed that malformed cellular transmissions are parsed in a way that triggers an unhandled exception inside the core com.android.phone process, causing critical system crashes without any user interaction or visible notification.

The attack only requires a target phone number, with no need for the user to open or interact with a message. The report notes that credential leakage from public databases can make obtaining target numbers comparatively easy, amplifying potential impact.

When attackers flood a device with malformed WAP Push messages, the device can become trapped in a sustained crash and recovery cycle. The article describes a scenario where twenty such messages can push the device into an ongoing loop: the telephony subsystem restarts, reprocesses queued messages, and the cycle repeats, sometimes triggering factory reset warnings. Carrier networks can worsen the situation by retransmitting unacknowledged payloads, meaning the device can remain affected even after reboots.

Evidence cited includes a technical disclosure on SMS of Death and independent exploit diagnostics, as well as repository logs indicating that Android Open Source Project developers introduced parsing validation and automatic purging of corrupted payloads. Google allegedly plans an official deployment in the November 2026 security bulletin, with vendors urged to apply updates to mitigate this disruption vector.