Android “SMS of Death” Bug Can Crash Phones Without Any User Action

A new Android security flaw can crash a phone after it receives a hidden text message. The attack needs no tap, link or other action from the user. In some cases, repeated messages can leave a device unusable.

Security researcher Mark Blaszczyk found the flaw in Android’s system for handling special SMS messages. The issue affects Android 12 and newer, with reports of successful tests on Google Pixel and Samsung Galaxy phones.

The attack uses a specially crafted WAP Push SMS. Android tries to process the message in the background, but an error can crash the system service that handles phone calls.

The message does not appear in the inbox, so users may never know what caused the problem. A single message can interrupt calls and cut off mobile service for a short time.

Repeated messages can cause more serious trouble. Android may keep trying to process the same message after a restart, leading to repeated crashes or a boot loop. The researcher says around 20 messages can make a phone very hard to use.

Google has included a fix in the October security update for Android 14 and newer. The updated system detects the malformed message and removes it instead of trying to process it again.

However, the fix may not reach every phone at once. Device makers must release updates for their own models, and older phones may no longer receive security patches.

Check your phone’s security update settings and install the latest available patch. On most devices, you can find this under Settings > Security & privacy > System & updates. The exact menu name may vary.

If your phone runs Android 13 or an older version, it may remain vulnerable if it no longer receives updates. There is no simple setting that blocks this attack, since the message is processed before it reaches your inbox.

The flaw is a reminder that phone security depends on timely updates. Even a message you never see can affect your device, so installing security patches is important.