This 'SMS of Death' exploit can remotely crash unpatched Android phones — without the user interacting with it in any way
Older Android devices will remain permanently at risk, experts warn.
A critical zero-click vulnerability in Android, known as "SMS of Death," can remotely crash unpatched devices without user interaction. This exploit, discovered by security researcher Mark Blah, takes advantage of an improperly validated header-length value in Android's WapPushOverSms.decodeWapPdu function. The vulnerability allows attackers to send malicious eight-byte WAP Push messages to Android devices, leading to a crash in the com.android.phone process and disrupting cellular functions.
Notably, the affected phones will not receive notification of the SMS, making it undetectable to the victim. In some cases, repeated messages can force the device into a reboot loop, leaving emergency connectivity vulnerable. Google has patched the issue for supported Android versions, but older devices remain at risk. The fix involves catching exceptions triggered by malformed text messages and deleting them from the SMS database.
However, users with older devices will not receive the patch, leaving them vulnerable indefinitely. To mitigate the risk, users are advised to install the latest Android security updates as soon as possible, as most manufacturers have reportedly pushed the fix.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
