Mark B says Google’s October 2026 Android security update includes a fix for a zero-click SMS vulnerability covering Android 14–17. In the researcher’s account, a malformed WAP Push data SMS can crash Android’s telephony process without the recipient opening a message. He says devices with the October 2026 security patch level or later are protected. Mark B’s technical account
How a hidden data message can interrupt calls
A WAP Push data SMS is not an ordinary text displayed in the inbox. Mark B says Android processes the malformed message automatically, then a failure in WapPushOverSms can crash com.android.phone, the telephony process that handles calls.
Mark B attributes the crash to an unchecked conversion of the WAP Push header length in decodeWapPdu(). In his description, that can produce an invalid negative array size and an uncaught exception. The reported effects include dropped active calls, including emergency calls, and a brief interruption to phone service while the process restarts.
The researcher reports that testing with a single message produced intermittent service outages lasting as long as a week. He also says around 20 messages could leave a device unusable for an extended period. Those are outcomes he reports from testing, not a fixed duration or threshold for every phone.
A telephony crash is different from a persistent loop
A crash in com.android.phone affects telephony; it does not by itself mean the entire handset is permanently unusable. Mark B says a more persistent loop can occur when queued, unacknowledged messages are retried as the phone boots and trigger the failure again.
Mark B documents an ADB recovery route that removes queued messages without a factory reset. It requires a computer and technical intervention, and is not a guaranteed recovery for every device.
The Android versions and patch scope Mark B reports
Mark B gives three separate version ranges: he reports reproducing the issue on Android 12–16, says Android 12–17 are affected, and places the October 2026 fix in Android 14–17. He also says Android 12 and 13 run the vulnerable code but are outside that update’s stated coverage.
The researcher names a Pixel 9 running April 2026 firmware and Samsung Galaxy devices among the test examples. The version that was reproduced, the broader affected range, and the stated fix coverage are different scopes. For the fix, Mark B ties protection to an Android security patch level of October 2026 or later, rather than to the Android version number alone.
