Android SMS Crash Flaw: Check Your Phone's Security Update
A newly public Android SMS exploit can interrupt calls without you opening a message. Install your phone maker's latest security update; if your handset no longer receives fixes, ask about support rather than relying on a VPN or spam filter.
The short version
What you need to know
- The researcher demonstrated call disruption and persistent crash loops on vulnerable phones. This is not evidence that every Android handset is being attacked.
- Check the manufacturer's system security update, not just updates to your messaging app. Availability depends on the handset and its support status.
- The vulnerable path processes incoming cellular SMS outside a normal consumer VPN tunnel. A VPN is not a fix or a filter for this attack.
Who needs to check their phone
Android users with an older or overdue security update should check their handset maker's update guidance. Researcher Mark B published the SMS of Death write-up on 29 October, followed by BleepingComputer coverage on 31 October. It describes a specially crafted incoming SMS that can crash Android's cellular-service process without the recipient opening anything.
This is a service-disruption finding, not a demonstrated theft of your photos, passwords or messages. The researcher reports dropped calls, including emergency calls, and repeated crashes on tested devices. The sources describe a public proof of concept; they do not establish a widespread attack campaign.
Why deleting suspicious texts is not enough
The problem is in Android's handling of a WAP Push data message before it appears in the usual inbox. The researcher says the message is not shown to the user. Advice to avoid links remains useful against phishing, but it does not address a flaw that needs no tap.
Repeated processing of a malformed message can prolong the disruption. Google's public source-code change explicitly says it catches decoding errors and deletes the triggering message record to prevent persistent crash loops. A reboot alone should not be treated as a guaranteed cure.
Check the update and the support window
Open your phone's Settings and look for its Android security update and system-update controls; menu names vary by manufacturer. Install available official updates and complete any requested restart. Updating a messaging app is not the same as installing a fix to Android's telephony framework.
The researcher says the fix shipped in the October 2026 security release for Android 14 through 17, while older Android 12 and 13 devices outside that update window did not receive it. That release-scope claim comes from the researcher, not a model-by-model rollout list. Google's code confirms a fix exists, but does not prove it has reached your particular handset. BleepingComputer also notes that this flaw is absent from Google's October bulletin.
If no update is offered, check the manufacturer's support page for your exact model and ask whether this telephony fix is included. Do not assume a phone is protected just because its Android version number is recent. If security support has ended, plan a move to a supported device rather than installing an unofficial repair APK.
If the phone is already repeatedly crashing
A crash by itself does not identify this attack. Seek the manufacturer's or carrier's support and explain the symptoms before choosing a factory reset, which erases data. The research describes a technical recovery method, but it is not a general consumer repair procedure. Do not download the demonstration app to test someone else's phone.
As a practical precaution, use another working phone if you urgently need to make a call and this handset cannot connect reliably. Do not make test calls to emergency services. Keep a current backup while the phone is working normally.
Why switching on a VPN will not stop it
A consumer VPN protects internet traffic carried through its tunnel. It does not intercept the cellular SMS processing involved here or repair Android's telephony code. Changing VPN servers, buying a different provider or turning on a kill switch is not a substitute for the device update.
Keep network privacy and device maintenance separate: a VPN can still be useful for its normal connection-privacy role, but the action for this report is to verify the handset's update and support status.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.