The Android "SMS of Death" Is Real: One Invisible Text Can Drop Your Calls

Researcher Mark Blaszczyk published a working exploit for CVE-2026-58882: an 8-byte malformed WAP Push message (port 2948) that crashes Android's com.android.phone process — dropping active calls, including emergency calls. Zero clicks needed; you never see the message.

Around 20 messages can brick a phone into reboot loops. The bug goes back to Android 12; Google's fix shipped in October updates for Android 14–17 only. Android 12/13 got nothing. No in-the-wild attacks confirmed, and it's availability loss, not data theft.

Protection: install your latest security update. There's no setting that blocks WAP Push.

Full technical breakdown: https://rohantechofficial.com/tech-news/android-sms-of-death-cve-2026-58882/