Science & Tech · Cybersecurity · 7 hrs ago
Hidden SMS flaw can disrupt Android phones; updates fix newer versions
A hidden SMS can disrupt Android phones by triggering a flaw in how the system handles certain messages.
The issue involves phones running Android 12 and later, including Google Pixel and Samsung Galaxy devices, though the sources differ on the full range of affected versions.
The messages use WAP Push, a system designed to let mobile operators send instructions to phones, and are processed without appearing in the inbox.
The disruption can disconnect calls and cellular service, make a phone unusable or cause repeated restarts; recovery may require technical help.
Google’s October security patch fixes the flaw on Android 14 and later, but phone makers may take weeks or months to deliver it, and Android 12 and 13 may not get a fix.
Users should check for and install available updates; if a phone is affected, do not choose “Wipe data”, which erases the phone’s contents.
A hidden, specially crafted WAP Push SMS can trigger crashes and other disruptions on Android phones running versions 12 to 17.
The message is processed in the background and does not appear in the inbox, so users do not need to interact with it.
Reported effects include dropped calls, loss of cellular service and, after repeated messages, a device becoming unusable or restarting repeatedly.
Google has issued a security fix for Android 14 and later, but the articles say phones on Android 12 and 13 may remain vulnerable.
People whose phones are affected are warned not to choose the recovery option that erases all data.
- Who
- Android phone users, especially those running Android 12 to 17, are affected; security researcher Mark Blaszczyk identified the flaw.
- What
- A specially crafted WAP Push SMS can disrupt phones, causing crashes, service loss or repeated restarts.
- When
- The researcher reported the issue to Google in May; a fix for Android 14 and later was included in the October security patch.
- Where
- On Android smartphones; researchers found the issue on Google Pixel and Samsung Galaxy phones.
- Why
- Android's telephony framework cannot properly process the specially crafted message, which is handled in the background.
This story does not have two clearly opposing sides.
Researchers reported the issue to Google.
Google made a security update available for Android versions 14 to 17, according to Handelsblatt.
Google included a fix for Android 14 and later, according to GSMArena.
- Affected versions
- Android 12 to 17, according to Handelsblatt
- Message type
- Specially crafted WAP Push SMS
- Researcher
- Mark Blaszczyk
- Patched versions
- Android 14 and later
- At-risk older versions
- Android 12 and 13 may remain vulnerable
2 sources
What people are saying
Wipe data