A serious Android vulnerability has emerged that can disrupt cellular service or even make a phone temporarily unusable after it receives a specially crafted WAP Push SMS message. The attack requires no interaction from the owner, making it especially dangerous for devices running Android 12 and above.
Security researcher Mark Blaszczyk discovered the issue in Android's telephony framework. When a malicious WAP Push message arrives, the system does not leave it in the inbox. Instead, Android attempts to process it in the background, which triggers a crash. This can interrupt active calls, temporarily cut off mobile network access, and after several such messages, leave the device in a state that is very hard to recover without technical help.
The problem has been confirmed on Google Pixel and Samsung Galaxy phones, though every Android phone running Android 12 or later is considered at risk.
Google initially disputed the vulnerability when it was reported in May, according to researchers. However, Android's engineering team later developed a fix and included it in the October security patch for devices running Android 14 or later. The patch works by recognizing one of roughly 20 potentially dangerous messages and deleting it immediately instead of trying to process it.
For users with Android 13 or older, there is currently little that can be done to protect the device. Those with Android 14 or later should install the October security patch as soon as possible.
Via
