Google Fixes Android SMS of Death Flaw in Versions 14–17, Leaving 12–13 Exposed

Android SMS of Death Exploit Uncovered

According to НВ — Техно: Security expert Mark Blach has revealed a zero-click SMS exploit (CVE-2026-58882) targeting Android devices, capable of freezing smartphones by sending malicious text messages. This vulnerability can trigger continuous reboot loops, particularly affecting devices running Android 12. Alarmingly, the harmful SMS can interrupt ongoing calls, including those to emergency services.

Attack Mechanics and Defensive Measures

The exploit works by dispatching 20 malicious SMS messages from another Android phone, causing Android 12 devices to restart into recovery mode every 90 seconds. Restoring normal operation requires a factory reset, a disruptive and inconvenient solution for users.

In response, Google rolled out security patches in October for Android versions 14 through 17, addressing the issue with a fix labeled "Fix remote DoS in decodeWapPdu." However, Android 12 and 13 remain vulnerable as they did not receive this update.

A GitHub user named Sakis discovered a workaround to delete the harmful SMS using Android Debug Bridge (ADB), though this method demands a computer and some technical expertise. Users on older Android versions are urged to prioritize system security updates, keeping in mind that:

• System updates often install automatically,
• Update availability depends on device manufacturers and carriers.

A device reboot may be necessary to complete the update process.

This exploit highlights the critical importance of promptly applying operating system updates to protect users. While Google has addressed the vulnerability in newer Android releases, those using outdated versions remain at risk. Awareness and proactive security practices are essential to safeguard mobile devices against such threats.