Malformed WAP Push text can crash Android phone service
Original title: Zero-Click ‘SMS of Death’ Flaw Lets Hackers Disrupt Android Phones With a Single Text
Repeated messages can corrupt the SMS database so the phone app crashes on every boot, and Google marked it Won’t Fix.
A researcher published a zero-click Android flaw dubbed SMS of Death. A malformed WAP Push message, which does not appear in the inbox, triggers an uncaught NegativeArraySizeException in WapPushOverSms.decodeWapPdu() and kills com.android.phone, dropping active calls. In testing, carrier retries of one unacknowledged message caused repeated outages for up to a week, and about 30 rapid messages corrupted the SMS SQLite store. Google marked the report Won’t Fix and treats it as a non-security issue, according to the disclosure site.
Unconfirmed: Google’s Won’t Fix and non-security classification is reported by the researcher, not confirmed in a Google statement here.
- Header length is converted from a long to a signed integer without a range check.
- Bytes 88 80 80 80 00 become -2147483648 and the allocation fails.
- A Pixel 9 on April 2026 firmware and tested Samsung phones crashed every time.
- Each message caused about one to two seconds without service.
- Android 17’s 2G and SMS-blaster protections do not appear to cover this bug.
Impact: Crashes telephony and can corrupt the SMS database
| Product | Affected |
|---|---|
| Google Android | Pixel 9 on April 2026 firmware; tested Samsung Galaxy and A-series phones |
- 1.Move the SIM to a non-Android phone so carrier retries are acknowledged, then clear corrupt records over ADB.
From the original article
2 min read at cybersecuritynews.com
A security researcher has published details of a zero-click Android flaw called “SMS of Death.” One malformed text message can crash the phone service on an Android device, drop active calls, and in the worst case leave the phone without telephony after every restart. Google has marked the report “Won’t Fix” and treats it as […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.