A newly disclosed vulnerability can render Android phones unusable without any action from the user. Security researcher Mark Blaszczyk found that a specially crafted WAP Push SMS message can trigger a serious failure in Android’s telephony framework on devices running Android 12 or newer.
Rather than showing the message in the inbox, Android attempts to process it in the background. That background processing fails and causes a chain of problems: active calls may drop, the phone can temporarily lose cellular service, and receiving multiple malicious messages can leave the device unusable. Recovery is often difficult and may require technical support.
The attack is especially dangerous because it requires no user involvement. It is not a phishing attempt or a link-based scam. Simply receiving the crafted message can cause harm.
The flaw has been confirmed on Google Pixel and Samsung Galaxy devices, though researchers say all phones running Android 12 or later are vulnerable. Google initially denied the issue after it was reported in May, but Android’s engineering team later developed a fix. That fix is included in the October security patch for devices running Android 14 or newer. Older phones remain exposed.
The fix itself is simple: Android recognizes one of roughly 20 potentially malicious messages and deletes it immediately instead of trying to process it.
If you use a phone running Android 13 or older, there is currently little you can do. Users with newer devices should install the October security patch as soon as it becomes available.
Via
