GoKawiilResearcher publishes proof-of-concept for 'SMS of Death' Android flaw CVE-2026-58882
Security researcher Mark Blah released a working exploit for a zero-click Android vulnerability that lets attackers crash phones or disrupt cellular service by sending a single malformed eight-byte WAP Push message over SMS. The bug stems from unchecked header-length parsing in Android's WapPushOverSms.decodeWapPdu function, which triggers a crash in the com.android.phone process and can drop active calls, including emergency calls. Google patched the issue for Android 14 through 17 in its October 2026 update, though it wasn't listed in the public bulletin, leaving Android 12 and 13 devices unprotected.