A malformed WAP Push data SMS can crash Android’s telephony process before the message appears in the inbox, according to security researcher Mark Blaszczyk, who publicly disclosed the flaw on October 29, 2026. A Google AOSP code change catches processing errors and removes the failed message tracker to prevent persistent crash loops. (Blaszczyk’s disclosure; AOSP commit 735d967)

How the reported SMS crash affects Android

WAP Push is a type of data message that Android processes automatically. Blaszczyk says the flaw is in WapPushOverSms.decodeWapPdu(): a malformed message can trigger an exception that crashes com.android.phone, the system’s telephony process. That can interrupt mobile service and drop active calls, including emergency calls. (Blaszczyk’s disclosure)

Blaszczyk reports reproducing the crash on Android 12 through Android 16, including on a Pixel 9 running April 2026 firmware and Samsung Galaxy and A-series devices.

What Google’s code change does

SavvyNik’s English-language cybersecurity roundup briefly explains the reported Android WAP Push flaw

AOSP commit 735d967 catches RuntimeException errors during WAP Push decoding and SMS broadcast. It then deletes the failed message tracker from the raw database, preventing that queued message from repeatedly triggering a crash. The commit was authored on June 15 and recorded on August 5, 2026. (AOSP commit 735d967)

Android versions and the security patch

Blaszczyk says the October 2026 update fixes the flaw on Android 14 through Android 17; Android 12 and 13 fall outside the official fix scope he describes. The reported crash-test range and patch range are different, so the test results do not mean every device in the affected-version range received the update. (Blaszczyk’s disclosure)

Google’s October Android Security Bulletin says security patch level 2026-10-01 or higher addresses the issues listed for that level. It lists CVE-2026-58865 as a critical Framework denial-of-service issue, but does not identify that entry as the WAP Push flaw. The bulletin does not list CVE-2026-58882, and its text does not connect CVE-2026-58865 to the WAP Push issue. (Google’s October 2026 Android Security Bulletin)