Zero-Click ‘SMS of Death’ Flaw Lets Hackers Disrupt Android Phones With a Single Text

A security researcher has published details of a zero-click Android flaw called “SMS of Death.” One malformed text message can crash the phone service on an Android device, drop active calls, and in the worst case leave the phone without telephony after every restart. Google has marked the report “Won’t Fix” and treats it as a non-security issue, according to the researcher’s disclosure site.

The bug sits in WapPushOverSms.decodeWapPdu(), the Android code that reads WAP Push messages. These are special data texts that never show up in the inbox. The code reads a header length from the message as a long number and then converts it to a smaller signed integer without checking the range.

The researcher shows that the five bytes 88 80 80 80 00 turn into -2147483648 after this conversion. Android then tries to create a byte array of that size.

That throws an uncaught NegativeArraySizeException and kills the com.android.phone process. The victim sees nothing. No message appears, and the sender’s number stays hidden.

Zero-Click ‘SMS of Death’ Flaw

Active calls end with the cause CS_DEATH as the process restarts. Each message causes one to two seconds without service. The carrier also resends texts the phone never acknowledges, so one message caused repeated outages for up to a week in testing.

About 20 messages left a phone unusable for a long time. The researcher tested a Pixel 9 on April 2026 firmware, and several Samsung Galaxy and A-series phones, and the crash happened every time.

Android already has other zero-click risks from fake cell towers. Google’s Android 17 adds protections against 2G downgrade and SMS blaster tricks. Those protections target a different problem and do not appear to cover this parsing bug.

Sending about 30 messages in quick succession is far worse. The repeated crashes collide with writes to the SMS store and corrupt the SQLite database that holds messages. After that, the phone app crashes on every boot, and a restart does not help.

A factory reset only works for a short time, because the carrier sends the stuck payload again. The researcher’s fix was to move the physical SIM into a non-Android phone such as an iPhone so the carrier’s retries get acknowledged. Then the corrupt records had to be cleared over ADB. An eSIM would make recovery much harder, and most users could not do it.

Zero-click attacks on phones are not new. In 2023, Citizen Lab found BLASTPASS, an iPhone zero-click chain used to install Pegasus spyware

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?