InfoSecBulletin Cybersecurity for mankind
A security expert shared information about a zero-click Android bug known as “SMS of Death.” Just one bad text message can make an Android phone stop working, drop ongoing calls, and in the worst scenario, leave the phone unable to make calls after every reboot. Google has marked the report “Won’t Fix” and treats it as a non-security issue, according to the researcher’s disclosure site.
The bug sits in WapPushOverSms.decodeWapPdu(), the Android code that reads WAP Push messages. These are special data texts that don’t appear in the inbox. The code reads a header length from the message as a long number and then changes it to a smaller signed integer without checking the limits.
‘SMS of Death’ Zero-Click Flaw Disrupting Android Phones With a Single Text
NIST Unveiled Guidance for Post-Quantum Cryptography Transition
Daily Cyber security update for 29.10. 2026
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
The researcher shows that the five bytes 88 80 80 80 00 turn into -2147483648 after this conversion. Android then tries to create a byte array of that size.
That throws an uncaught NegativeArraySizeException and kills the com.android.phone process. The victim sees nothing. No message appears, and the sender’s number stays hidden.
Zero-Click ‘SMS of Death’ Flaw
Active calls stop because of CS_DEATH when the process restarts. Each message leads to one or two seconds without service. The carrier sends texts again that the phone does not recognize, which caused one message to lead to repeated outages for a week during testing.
About 20 messages made a phone unusable for a long time. The researcher tested a Pixel 9 with April 2026 software and different Samsung Galaxy and A-series phones, and the crash happened every time.
Android has other risks from fake cell towers that don’t need clicks. Google’s Android 17 adds safety against 2G downgrade and SMS tricks. These protections deal with a different issue and don’t seem to fix this parsing bug.
Sending around 30 messages quickly is much worse. The crashes mix with writing to the SMS store and damage the SQLite database that keeps messages. After that, the phone app fails every time it starts, and restarting doesn’t fix it.
A factory reset helps for a little while because the network sends the stuck data again. The fix from the researcher was to put the SIM in a phone that is not Android, like an iPhone, so the network’s retries are accepted. Then, the bad records had to be removed using ADB. An eSIM would make it much harder to recover, and most users would not be able to do it.
Zero-click attacks on phones are not new. In 2023, Citizen Lab discovered BLASTPASS, a way to use zero-click on iPhones to install Pegasus spyware.
Related news:
SMS Stealer Targets 600 Global Brands: Over 105,000 samples identified
