Android SMS of Death Flaw: Who Is Exposed and How to Stay Safe

If your Android phone has not installed the October 2026 security update, a single text you never see could knock out its calling service. That is the core of the Android SMS of Death, a flaw publicly disclosed on October 29 by a security researcher who goes by Mark B. It affects phones running Android 12 through Android 17, according to his technical write up.

The bug lives in the part of Android that handles WAP Push messages, an old SMS format carriers once used to send settings. A malformed message crashes the phone process (com.android.phone) with no tap or click from the owner, and the text never shows up in your inbox.

What one hidden text does to a phone

Each crash takes the calling service offline for a second or two while it restarts. Any active call drops, and the researcher says that includes emergency calls.

It gets worse because carriers resend messages a phone never acknowledges. In the researcher's testing, one message caused on and off outages for up to a week, and around 20 messages could leave a device unusable for a long stretch. Cybernews reports that a stuck message can push a phone into a boot loop that lands on Android's recovery screen after roughly 90 seconds, the point where many owners might assume a factory reset is the only way out.

The researcher says the crash reproduced every time on a Pixel 9 running April 2026 firmware and on several Samsung Galaxy phones, including A series models.

Phones that are covered and phones left behind

Google wrote a fix on June 15, about six weeks after the bug was reported on May 5. It shipped with the October 2026 Android security release for Android 14, 15, 16 and 17, per the write up, and phones on earlier patch levels remain vulnerable. Cybernews, which reports the flaw as CVE-2026-58882, says the fix has yet to reach every supported device.

Here is where that leaves different owners:

• Pixel owners: Google says its monthly updates usually reach every Pixel within about a week and a half of release, so most Pixels should already be offered the October patch.
• Samsung and other brands: timing depends on the maker and sometimes the carrier, so check rather than assume.
• Phones on Android 12 or 13: no fix has been released for these versions, and many will never get one.
• Phones past their update window: the same goes for any model that no longer receives monthly security patches.

Five steps to take this week

1. Open Settings, then About phone (or Security), and find the Android security update date. You want October 1, 2026 or later.
2. If it is older, go to Settings, then System or Software update, and install whatever is waiting. Restart when asked.
3. If no update is available and the phone runs Android 12 or 13, treat it as exposed. It may be time for a replacement; our picks for the best phones under $500 favor models with long update promises, and our iPhone vs Android guide helps if you are weighing a switch.
4. If the phone keeps losing service or rebooting into a recovery screen, do not choose the wipe data option, the researcher warns. Recovery may need a computer and Android's debugging tools, so a carrier store or repair shop is a sensible next stop. Random reboots have other causes too, and our checklist on how to know if your phone is hacked and guide to removing a virus from Android help rule out malware.
5. Do not download or forward any test code for this bug. A working proof of concept is public, and Cybernews warns that attackers can already use it.

The flaw is a reminder that phone security is not only about apps you install. For more phone news, see our gadgets page. The quickest protection is still the boring one: let the October update install tonight.