Android SMS flaw can cut calls; fix only on Android 14+
Security researcher Mark Blaszczyk found a WAP Push SMS attack that can disconnect calls and disable phones, according to GSM Arena.
A security researcher, Mark Blaszczyk, has disclosed a vulnerability affecting phones running Android 12 or later that can disconnect active calls and leave devices unusable, according to GSM Arena. A fix has been included in Google's October security patch, but only for devices running Android 14 or later.
The attack relies on a specially crafted WAP Push SMS message that Android's telephony framework cannot properly process. Instead of showing the message in the inbox, the system tries to handle it in the background, which triggers an error.
The reported effects include active phone calls dropping, temporary loss of cellular service and the device becoming unusable after multiple messages are received. Recovering a phone in that state reportedly requires technical support.
The vulnerability has been found on Google Pixel and Samsung Galaxy phones, according to the report.
Patch covers Android 14 and later
The Android engineering team's fix makes the system delete one of 20 potentially malicious messages rather than processing it. Phones running Android 13 or older remain vulnerable. Users on Android 14 or later are advised to install the October security patch.
Blaszczyk first reported the issue in May, and Google denied it at the time, according to GSM Arena.
Quick answers
Which Android versions are affected by the SMS vulnerability?
Phones running Android 12 or later are affected; the fix in the October security patch covers devices on Android 14 or later, while Android 13 and older remain vulnerable.
What does the October Android security patch change?
It makes Android delete one of 20 potentially malicious messages instead of processing it, preventing the error triggered by the crafted WAP Push SMS.