Zero click, silent, remote Android DoS
smsofdeath.com
smsofdeath.com
Maybe I'm wrong and naive but given that the AU law was done to force people move forward from 3G only phones because the network was being shutdown and 000 moved to 5G (I believe), it's a law for operator to contact their customers still using an old phone and migrate them to a newer one. I doubt they will block automatically the number if you are under that DOS for a few days in a row.
You doubt correctly. The law is about blocking IMEI numbers of phones that use the 3g network to dial 000 despite being 4g devices.
https://android.googlesource.com/platform/frameworks/opt/tel...
It's assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We've had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:
https://grapheneos.org/releases#2026072900
Google mishandled the issue report. There was likely an internal miscommunication and they handled the report incorrectly. It's possible the issue was already filed internally and they meant to close it as a duplicate instead of WONTFIX. Closing it at all may have been an error.
they did set it as a duplicate of a ticket they disregarded.
I found the Chrome team the easiest to communicate with, devs would actually respond.
page updated to reflect.
Android's public issue tracker isn't the real issue tracker. They create internal issues for what's reported there. That means the discussion about it doesn't happen there. Security bug reports are mainly treated as a request for a bounty and little communication happens beyond what's related to receiving a bounty for it. If someone else filed it then it gets closed and no further info is provided. If someone external filed the first report, they hardly get any updates themselves beyond eventually being informed which Android Security Bulletin included it months after it was disclosed to OEMs and allowed to be patched.
Correct me if I'm wrong, but the carrier configuration messages can normally only come from carriers. The demo APK sends a message to the phone itself, but sending SMS messages requires special confirmation.
Practically speaking, what's the risk?
Only “fix” for this attack is to place SIM card in a non-Android phone to ack the inbound messages, or wait a few days of constant disconnects.
I don't think this is what happens here, as this could then be fixed by providers filtering inbound messages with this content after the fact.
Rather, the SM seems to be stored in a database on the Android device and repeatedly processed, which is potentially much harder to fix.
Or did I misunderstand you and can you input any phone number to cause this issue? If so that would sound more like a carrier issue then a android issue to me
The software is installed on the _sender_ device.
That's not what the readme on the repo says.
"Install on a sender device, enter (or auto-fill from an active SIM) the target number, pick the sending SIM, and tap SEND CRASH SMS. Observe on the target..."
https://android.googlesource.com/platform/frameworks/opt/tel...
It's assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We've had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:
https://grapheneos.org/releases#2026072900
Google mishandled the issue report. There was likely an internal miscommunication and they handled the report incorrectly. It's possible the issue was already filed internally and they meant to close it as a duplicate instead of WONTFIX. Closing it at all may have been an error.
1. A carrier should not be able to render my device unusable in a manner that persists after I remove the SIM.
2. Dual SIM is a thing. One carrier should not be able to disable the other one.
(You do appear to be incorrect on the technical point as well.)
For the lulz.
1. Revenge on an ex.
2. Send someone the packet, set up a situation where they need to call 911.
I'd like to know - can any devices actually put such a malformed message onto the carrier network? It probably requires at least a custom app that would never be allowed on an app store, if it's possible at all. And do any carriers actually let it go through their network and to a device like a normal message? It's entirely possible the malformed message would crash some software in the carrier's processing stack first and so never be delivered. And if it doesn't, they could easily add a check to block such messages. It's difficult to believe they don't already have some sort of protection against spamming tons of messages to any device. It's also entirely possible it works differently on different carriers, and some but not others might add blocks for this but not make a press release about it or anything.
This seems more like meh, minor bug, fix it quietly in the next Android release, not OMG the world is on fire to me.
Apk provided can be installed on an attackers phone, you specify the msisdn (phone number) of victims phone, click send and it crashes telephony app of the victim.
Multiple messages may create a race condition that corrupts an SQLite database that stores message which stops telephony from functioning as a phone. WiFi will still work so I guess you can use it as a tablet as long as you don’t mind the constant dialogs popping up.
Tested in AU, US, DE and UK with 100% success rate.
The author has provided an APK that claims to do just that. Hacking tools aren't allowed on app stores, no, but that has no bearing on the severity of vulnerabilities they exploit.
> And do any carriers actually let it go through their network and to a device like a normal message? It's entirely possible the malformed message would crash some software in the carrier's processing stack first and so never be delivered.
Apparently, unless you're accusing the author of lying.
> And if it doesn't, they could easily add a check to block such messages.
Your ISP could block RDP but that doesn't lessen the severity of RDP vulnerabilities, shift responsibility, or lessen the need for the vendor to respond in any way, that's not how this works.
This is an Android vulnerability and it should be assumed that the carrier is indifferent, actively hostile, cooperating with law enforcement to carry out this attack, or someone might carry out this attack using an IMSI catcher.
> It's difficult to believe they don't already have some sort of protection against spamming tons of messages to any device.
20? I doubt it. Do you think the author is lying?
> It's also entirely possible it works differently on different carriers, and some but not others might add blocks for this
Indeed. What's indefensible is Google's classification that this isn't a security vulnerability.
perhaps even a rogue employee
And it's not that hard, bring down a VPN or some core routing service.
How do you make calls without trusting them?
[0] https://android.googlesource.com/platform/frameworks/opt/tel...
:grimace:
Overall a bit frustrating to have such a fancy webpage with a dedicated address, but then no description on how to actually #1 identify and #2 recover an affected device...
> "Once the database is corrupt, com.android.phone no longer needs a fresh message to fail: it crashes immediately on every boot as it reads the damaged store [..] a factory reset only helps temporarily"
Can't I delete the storage of com.android.phone instead of a full factory-reset?
Only fix is to place sim/esim into non Android device
The page describes that this part is resolved by putting the SIM into a non-Android device to receive the queued messages and acknowledge to the network.
To then recover the device it only vaguely mentions "adb commands" and "factory reset", but I can't find a description what actually needs to be done on the device.
I guess the specific question is: The message database that is corrupted due to this issue, is this DB owned by (and stored as part of) com.android.phone?
Just before they were removed, I decided to eliminate all of my Rules and Modes entirely, because they were turning out to be extremely unreliable, and there was a bug whereby the Pixel went back into DND mode after a restart, even when it had already been moved outside of the location. It was also quite unpredictable how any Mode would behave, when there were all kinds of settings for each one, and it was just too much to set up and keep track of.
Today, DND is even more onerous. In the Clock app's Alarms tab, if DND is enabled, the app prevents me from editing or deleting or modifying, in any way, the alarms as they are set. This is terrible. You see, Google really, really wants us to disable DND and keep it off forever. DND is very bad for Android. So they are making it as inconvenient as all-get-out to leave DND enabled. If it were up to me, I'd leave it defaulted to "on" until I wanted to be disturbed.
Items placed in a Bag of Holding may not be retrieved within half a mile of a real-life police station
It would be unfortunate for them to phone you precisely in the small period where DND was turned on as you walked past the opera house (even a large one would be, what, under two minutes of walking?) and not try you again.
(Because if you have instant location-based DND, yes, it might turn on as you walk by an opera house but equally it would turn off when you were past the opera house. Normally, though, I'd expect location-based DND to only kick in after a certain period of time in the same location - say 10 minutes.)
Plus the fact you need the phone to be active when waiting for opera friends in front of the door...
And the fear of the system failing during Lohengrin overture. I prefer to set it on silence myself
Perhaps it was never really declassified in the tracker.
eSims are great until they are not. Give me a second physical SIM tray over an eSim any day of the week.
*2767*3855#
Thanks to some genius at Samsung who thinks this is a good idea.
"core Android Telephony Framework GPS race condition from the early days of Android (roughly 2011–2014)."
My AI was unable to find any existing webpages for this though?
Also there was this:
This requires carrier to cooperate.
Perhaps the site's tagline was all they read and admittedly I'd have phrased differently.
> A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls), with zero interaction from the victim.
> Anyone can send an specially crafted SMS to repeatedly crash the victim's phone app on Android without user interaction. Google didn't fix it, here's an app you can download to send that SMS and disable anyone's phone remotely.
https://android.googlesource.com/platform/frameworks/opt/tel...
It's assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We've had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:
https://grapheneos.org/releases#2026072900
Google mishandled the issue report. There was likely an internal miscommunication and they handled the report incorrectly. It's possible the issue was already filed internally and they meant to close it as a duplicate instead of WONTFIX. Closing it at all may have been an error.
That is a function of the training data/method, like many of AI's problems. This doesn't stop it being a problem of course, but it shouldn't be a surprise.
Big bugs, like heartbleed, over the years have had breathy websites going over how serious the problem is because the problem was that serious, so the models associate that sort of wording with bug reports. Less serious bugs don't get the same excited treatment, repeated in many many places, so more measured descriptions figure in the training data relatively less.
https://android.googlesource.com/platform/frameworks/opt/tel...
It's assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We've had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:
https://grapheneos.org/releases#2026072900
Google mishandled the issue report. There was likely an internal miscommunication and they handled the report incorrectly. It's possible the issue was already filed internally and they meant to close it as a duplicate instead of WONTFIX. Closing it at all may have been an error.
EDIT: actually already fixed in https://review.lineageos.org/c/LineageOS/android_frameworks_...
There's yet another PDU fixup that stems from negative index
False negative? I honestly don't know what we can do about it. If this is a real issue, maybe another llm will rediscover it and it eventually will get triaged right?
That has more to do with the severity of heartbleed than the fact that it had a name and a logo. I've since seen a lot of vulnerabilities try to market themselves with websites, cute names, and stupid logos but I still don't remember them because they still just weren't big enough to actually be memorable.
Before this practice in general you simply released the exploit and see if enough chaos triggers a fix.
A bit like the postal system. Yes, it's meant to send physical letters and what not to my home, but it still sucks when I get ads that just goes straight into the trash. Yes, you're using the system as intended, but I still consider your business slop if you send ads to me this way.
> Google committed a fix on June 15th and it was shipped in the security preview patches in mid-July. GrapheneOS shipped it in our security preview releases in July. It's in the upcoming November security bulletin but a patch was pushed to AOSP in October:
> https://android.googlesource.com/platform/frameworks/opt/tel...
Www.github.com/jegly
err, how can I send an SMS like this? Would a mobile network even accept/forward such an SMS?
Little hard reading through the vibe slop here
I think Android removed the ability to send more annoying messages through its normal APIs (like flash SMS messages) but if you have access to any modem (either a smartphone or a full ESP32 dev board costing <50 bucks on AliExpress for 4G LTE), you can bypass any such restriction.
Carrier firewalls will probably filter these messages out but I wouldn't rely on it.
Those APIs are probably still online, and still require to nail your ass to the contract, but technically I would assume it's possible.
But not all SMS are text messages for the user.
My provider had given me a remotely managed router. It was trivial to change the configuration and have it work normally.
- targeted suppression - targeted disruption
Disclaimer for non-aussies (like me): That's not the newest hacker slang for something, 000 is the phone number of Australian's emergency services...
Replace with "can cut you off from 911" or 112, 999, etc. as needed (optionally wear sunglasses and add hand-gestures to amplify the effect)
...or just call it "emergency services"
Additionally, even those that dislike slop may still upvote a security issue that they think is important.
The discussion is moreso about the vulnerability (and PoC) itself rather than the AI-generated aspects.
Also, I don't understand Googles position here. On android the phone ia not part of the OS and can be updated via an app or framework update. Why not just fix this as a functional bug?
https://android.googlesource.com/platform/frameworks/opt/tel...
It's assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We've had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:
https://grapheneos.org/releases#2026072900
Google mishandled the issue report. There was likely an internal miscommunication and they handled the report incorrectly. It's possible the issue was already filed internally and they meant to close it as a duplicate instead of WONTFIX. Closing it at all may have been an error.
Google are rather vague in their triage, they just said temporary DoS does not qualify, then rejected to investigate further.
I'm not familiar with WAP Push and how it works, but is it possible to disable it or block that port on a non-rooted phone?
Look at this Claude shit:
> Zero-click. The victim does nothing. No tap, no open, no notification.
> Silent. Nothing appears in Messages; the attacker's number is never shown.
Congrats, now you sound like yet another AI YouTube advertisement. "You control when we... ...woohoo"...
OP, please, if you think you have important information, please write it up yourself, I am so sick and tired of being sent LLM generated Markdown files with zero human input, and now you're just publishing that on a website.
FFS.
Oh you had Claude publish your name presumably so you'd get credit for "your" "discovery".
Mark Blaszczyk, please do better.
the message is silent, no notification notifying of the attackers origin, doesn't matter if it's locked, or connected to mobile data, so i stand by what is written.
I don't care about the credit, i have enough CVE's under my belt which are higher severity, none which have dedicated write-ups. i care that this gets fixed and give answers to those who are experiencing their phones constantly disconnecting from carrier.
The trend of Claude referring to everything as having a "shape" irrationally annoys the hell out of me. What an absolutely idiotic way to say "X is like Y."
I used to write like this, but I can't anymore. (I suspect enough people did in the training set that that's why it ended up being part of the vernacular.)
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c10
And again with the follow-up issue:
Also, I want to expunge the word "shape" from my vocabulary at this point. I think I'm developing a nerve twitch just reading it.
But imo it's not a bad thing. Most sites looked like shit in the past. The content is usually where I focus my changes when dealing with LLM generated HTML. And if I want it slightly less LLM flavored in terms of design I just pick a random design system to tell it to use. Apple HIG, IBM Carbon, etc.
Usually just picking your own palette, a design system, and making it remove all the stupid details it decides to add will improve your end result by a lot.