A recently disclosed zero-click vulnerability—dubbed the “SMS of Death”—can render Android phones partially or wholly unusable with a single, malformed WAP Push message. The exploit leaves no trace in the user’s inbox, can drop active calls, and in some tests caused persistent loss of telephony that survived reboots and even factory resets until carriers’ retry behavior was addressed.
How the flaw works
The bug resides in WapPushOverSms.decodeWapPdu(), the Android routine that parses WAP Push messages. The vulnerable code reads a header length as a long value, then converts it to a smaller signed integer without validating the range. The researcher demonstrated that a specific five-byte sequence (88 80 80 80 00) becomes -2,147,483,648 after conversion, prompting Android to try to allocate a byte array of that size. This throws an uncaught NegativeArraySizeException that kills the com.android.phone process. Because these are special data texts that don’t appear in the inbox, victims receive no visible message and the sender’s number remains hidden.
The real-world impact
When the phone process crashes, active calls terminate with the cause CS_DEATH as the service restarts. Individual messages can cause one to two seconds of service disruption, but carrier retry behavior can make the outage far worse: repeated retransmissions of an unacknowledged message produced prolonged outages in testing, with one message triggering repeated outages that lasted up to a week. Sending many messages in quick succession exacerbates the problem; roughly 30 messages caused repeated crashes that interfered with writes to the SMS store and ultimately corrupted the SQLite database used to hold text messages. After database corruption, the phone app crashed on every boot.
Persistence and recovery challenges
The researcher reported that about 20 messages left a device unusable for an extended period. A factory reset provided only temporary relief when carriers continued to resend the problematic payload. In testing, a practical recovery approach involved moving the physical SIM to a non-Android phone (for example, an iPhone) so the carrier’s retries would be acknowledged; the corrupt records then had to be cleared over ADB. The researcher noted that eSIMs would make recovery much harder for most users.
Scope, testing, and vendor response
The crash was reliably reproduced on a Pixel 9 running April 2026 firmware and on several Samsung Galaxy and A-series phones. According to the researcher’s disclosure site, Google has marked the report “Won’t Fix,” treating the issue as a non-security problem. Android 17 does include protections against other cellular threats—such as 2G downgrades and SMS blaster tricks—but those defenses target different problems and do not appear to cover this specific parsing bug.
Context: zero-click history and emerging threats
Zero-click exploits that require no user interaction are not new; in 2023 Citizen Lab documented BLASTPASS, an iPhone zero-click chain used to deploy Pegasus spyware. The disclosure also highlights a current concern: AI is making cyberattacks faster and cheaper. The researcher’s disclosure ends with a pointed reminder: Are your defenses ready to respond at machine speed?
Licensed under CC BY-ND 4.0 International