Android SMS of Death Warning: Get the New Fix

The Android SMS of Death bug went public on 29 October. One hidden text can crash the calling service on an Android phone and cut off a live call, even an emergency call. You don’t have to tap anything, and the message never shows up in your inbox.

That matters in India. Many of us use Samsung Galaxy A and M phones, Redmi, vivo, OPPO and Realme handsets, and many of them get security updates late or not at all.

The good news is that a fix exists. This piece explains what the bug does, which phones were tested, which update fixes it and how to check your phone in two minutes.

The Short Version

• What it is: A malformed WAP Push SMS that crashes com.android.phone, the part of Android that handles calls and mobile signal.
• What it does: Each message cuts service for one to two seconds and drops any active call, including emergency calls.
• Phones tested: A Pixel 9 on April 2026 software and several Samsung Galaxy phones, including A-series models.
• The fix: The researcher says phones on the October 2026 Android security patch or later are protected. GrapheneOS says it will also appear in the November bulletin.
• What to do: Check your security patch level today and install any pending update.

What Is the Android SMS of Death Bug?

Independent researcher Mark Blaszczyk published the details on his site, SMS of Death, on 29 October 2026. He first reported it to Google’s bug bounty programme on 5 May 2026.

The flaw sits in Android’s own telephony code, not in any one brand’s skin. A WAP Push message is a special kind of data SMS. Android reads a length value from it but does not check whether that value makes sense. So a crafted value turns negative, the code throws an error, and the phone process crashes.

In plain words, your phone’s calling brain restarts. Your screen may look normal, but for a moment you have no network.

Why it is called “zero-click”

You don’t open a link or install an app. According to CyberInsider’s report, the message creates no inbox entry or notification and does not reveal the sender. An attacker only needs your phone number.

That is what makes this scarier than a normal scam SMS. However, the damage is to your calls and signal, not your bank account. There is no report of data theft.

How Bad Can the Android SMS of Death Get?

One Android SMS of Death message is a short hiccup. The real problem is what happens next.

Because the phone crashes before it confirms the SMS arrived, the carrier keeps trying to deliver it again. In the researcher’s tests, a single message caused on-and-off outages for up to a week.

It gets worse with more messages. Cyber Kendra reports that about 20 messages left a test phone unusable for a long time. Around 30 sent quickly could corrupt the SMS database, so the phone crashed on every boot.

Does a factory reset fix it?

Not by itself. The researcher found that a reset gave only temporary relief, because the queued messages were delivered again. Recovery needed the physical SIM to be moved into a non-Android phone, plus technical cleanup with a computer. He warns that eSIM users could find recovery harder.

So prevention is far easier than cure. That brings us to the fix.

Has Google Fixed the Android SMS of Death Flaw?

Yes, but the story is messy. Google classed it as a non-security bug and repeated that on 29 October. Yet its own engineers wrote a fix months ago.

Here is the timeline from the researcher’s site and the reports above:

Google’s fix does not add the simple check the researcher proposed. Instead, the phone now catches the error and deletes the bad message, so it can’t crash the phone again on redelivery.

A GrapheneOS maintainer wrote on the GrapheneOS issue tracker that the fix is also in the upcoming November security bulletin. So expect it to show up in more release notes next week.

Which Phones Are at Risk in India?

The researcher reproduced the crash on a Pixel 9 and on several Samsung Galaxy phones. He does not claim a full list of affected brands. Because the bug is in core Android code, it is safest to assume any Android phone on an older patch could be affected until your maker ships the fix.

Here is a quick way to read your risk:

The researcher’s site says Google’s fix covers Android 14 to Android 17. That means older phones that have stopped getting updates are the biggest worry. If your phone is stuck on an old version, read our guide on what happens when a phone hits end of life.

What about iPhones?

The reports cover Android’s telephony code only. No iPhone has been named. Still, Apple users should keep updating too; see our look at whether iOS 27.2 is safe to install.

How to Check If Your Phone Has the Android SMS of Death Fix

This takes two minutes. Menu names vary a little by brand, but the idea is the same.

On a Samsung Galaxy phone

1. Open Settings and tap About phone.
2. Tap Software information.
3. Look at Android security patch level. You want 1 October 2026 or later.
4. If it is older, go back to Settings > Software update > Download and install.

Samsung’s October patch is already reaching some phones in India. For example, SammyGuru reports that the Galaxy S26 FE update has expanded to India. Many Galaxy A models are on a quarterly schedule, though, so yours may take longer. Our One UI 9 India rollout tracker shows where Samsung’s big update stands.

On a Google Pixel

1. Open Settings > About phone > Android version.
2. Check Android security update.
3. To update, go to Settings > System > Software updates.

On Xiaomi, Redmi, POCO, OnePlus, vivo, iQOO, OPPO or Realme

1. Open Settings > About phone.
2. Look for Android security patch or Security update in the version details.
3. Then check the system update section and install anything pending.

Xiaomi users waiting on the next big release can see our HyperOS 4 release date guide.

What If Your Phone Starts Crashing Calls Now?

Most people will never see an Android SMS of Death attack. Still, know the warning signs: calls that drop again and again, “No service” that flickers on and off, or a phone stuck rebooting.

If that happens:

1. Install any pending system update first, if the phone stays up long enough.
2. Do not pick “wipe data” at a recovery prompt as your first move. The researcher advises against it.
3. Take the phone to the brand’s service centre or a trusted technician. The full recovery needs a computer and some skill.
4. Keep a second phone or a basic feature phone handy for emergency calls, like 112, until it is fixed.

Also, back up your phone regularly. Recovery can involve data loss.

Should You Worry About the Android SMS of Death? Our Verdict

Here is our honest take, by type of user:

• Phone on the October 2026 patch or later: Relax. You are reported as protected.
• Phone that still gets updates but is behind: Update now. Then check again next week for the November patch.
• Phone that no longer gets updates: This is a good reason to plan an upgrade. A phone that can drop an emergency call is a real safety risk.
• Buying a new phone this Diwali: Pick a brand with a clear, long update promise, and check the patch level in the store.

There is no sign yet of attacks in the wild. However, the proof-of-concept is now public, so the risk can grow. We will update this post when the November bulletin and brand patch notes are out.

Conclusion

The Android SMS of Death is a rare bug that can silence your phone without you touching it. The fix is simple: get on the October 2026 security patch or newer, and keep updating. Google calls it non-security, but if your calls matter, treat it as urgent.

What security patch level does your phone show right now? Tell us your model and patch date in the comments.