Google Android · Disclosed

Zero-click Android SMS flaw drops calls; Google 'Won't Fix'

Oct 29, 2026 · 1 min read

A malformed WAP Push SMS silently crashes an Android system process with no user interaction, dropping active calls and disabling cellular service; rapid repeated messages can corrupt the SMS dataset and crash telephony after every reboot. The researcher reported the flaw to Google in May and disclosed it on October 29 after the report and appeals were rejected. Per the disclosure, Google classified it as a non-security issue and won't fix it, and there is no evidence of exploitation in the wild.

By HIFY Radar newsroom Updated 10/29/2026 03:43 PM Get this every day →← Back to the feed 1 source

MediumVulnerabilityDisclosedUnpatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A researcher disclosed an unpatched Android flaw where a malformed SMS, with no interaction from the victim, drops active calls and disables cellular service. The message never appears in the inbox and carrier redelivery can trigger the crash repeatedly. In testing, rapid repeated messages corrupted the SMS dataset and telephony crashed after every reboot.

Why it matters

Devices relying on calls and cellular data can go offline without warning. The flaw was tested on Pixel 9 and multiple Samsung Galaxy and A-series devices. Per the disclosure, Google classified it as a non-security issue and won't fix it, leaving devices exposed.

What to do

No patch is available. Identify Android devices used for critical calls and field operations, and prepare a response to recurring cellular outages. Track Google and carrier guidance on SMS redelivery.

For the technical team

Affected: Google Android (recebimento de SMS WAP Push) · Android, on receipt of WAP Push SMS; tested on Pixel 9 and multiple Samsung Galaxy and A-series devices, per the disclosure.
Exploitation: No CVE assigned and no evidence of exploitation in the wild, per the disclosure. Flaw publicly disclosed on October 29 by the researcher.
Fix: No patch available; Google classified it as a non-security issue and marked it 'Won't Fix', per the disclosure.
Vector: Malformed WAP Push SMS sent remotely to the device; denial-of-service flaw requiring no user interaction. The message does not appear in the inbox and carrier redelivery can repeatedly trigger the crash. Rapidly sending multiple messages can corrupt the SMS dataset.
More details: The researcher reported the flaw to Google in May and publicly disclosed it on October 29 after the report and subsequent appeals were rejected. The SMS crashes a system process, dropping active calls and temporarily disabling cellular service; once the SMS dataset is corrupted, telephony crashes after every reboot.