Google won't fix zero-click Android SMS crash that drops emergency calls

Overview

Updated 1 hour ago

One malformed SMS crashes the phone app on every Android handset tested, from Pixel to Samsung Galaxy. The WAP Push message never appears in the inbox. Victims see nothing before calls drop, including calls to emergency services.

Google's security team reviewed the bug across three tickets and four engineers over 177 days, then closed it as Won't Fix. Researcher Mark Blaszczyk published the technical details and proof of concept on October 29.

Repeated messages corrupt the phone's SMS database, turning a momentary crash into a device that fails on every restart. Recovery requires moving the SIM to a non-Android phone and clearing the damaged database through the Android Debug Bridge.

Why it matters

A stranger can knock any Android user off the network with a text they never see, and Google says it won't patch the flaw.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

100%

Crash reproduction rate on tested handsets

Pixel 9 and Samsung Galaxy and A-series devices all crashed with a single message.

~30

Messages needed to corrupt the SMS database

Rapid delivery triggers SQLite corruption that crashes the phone on every boot.

177

Days from report to public disclosure

The disclosure came 87 days after the VRP's standard 90-day window closed.

Google engineers who reviewed the report

All four concluded the issue did not meet the severity threshold.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Mark Blaszczyk

Independent security researcher

Published full disclosure after Google declined to patch

Organizations Involved

Google Android Security Team

Corporate security division

Classified the WAP Push crash as a Non-Security Issue

The group that runs Google's Android Vulnerability Reward Program and triages security reports.

Timeline

May 2026 October 2026

9 events Latest: Today

Tap a bar to jump to that date

October 2026
Final Won't Fix and public disclosure
Today Disclosure

Google issues final Won't Fix; researcher publishes full disclosure and proof of concept.
Today
Status update requested
Request

Researcher requests a status update after three months without response.
2 days ago
July 2026
Report reopened, then marked duplicate
Decision

Google reopens the report after it surfaces on Discord, then confirms it as duplicate.
July 16th, 2026
June 2026
Disclosure hold requested
Request

Google asks the researcher to hold disclosure under the 90-day VRP timeline.
June 23rd, 2026
SQLite corruption reported
Report

Researcher reports rapid sends corrupt the SMS database, crashing the phone on boot.
June 22nd, 2026
First Won't Fix decision
Decision

Google closes report as Won't Fix, saying it is not a security vulnerability.
June 20th, 2026
Appeal rejected in three minutes
Appeal

Resubmission is closed as not reproducible within three minutes.
June 20th, 2026
May 2026
Priority request
Appeal

Researcher requests priority citing five-handset reproduction and emergency-call impact.
May 15th, 2026
Report filed with Google's VRP
Report

Blaszczyk files the report with a one-line bounds-check fix.
May 5th, 2026

Scenarios

Google reverses course and patches WapPushOverSms

Possible Resolves by Q2 2027

Discussed by: Security researchers following the public disclosure

The disclosure could push Google to reverse its Won't Fix decision. The fix is a bounds check before the integer cast on line 217 of WapPushOverSms.java, which the researcher provided in the original report. A patch would ship in a future Android Security Bulletin.

Carriers filter WAP Push messages to blunt the attack

Possible Resolves by Q2 2027

Discussed by: The researcher's offer to brief Australian carriers before disclosure

Carriers can filter malformed WAP Push messages at the network level, preventing delivery to subscribers and neutralizing the attack without a device patch. Australian carriers are the most likely first movers because the bug interrupts access to Triple Zero, which the regulator treats as a mandatory service property.

Google holds Won't Fix and the flaw goes unpatched

Likely Resolves by Q2 2027

Discussed by: Google's final decision quoted in the disclosure

Google maintains its classification and ships no patch. The vulnerability stays exploitable on any Android device that accepts data SMS. Stock Android and older devices remain exposed while the disclosure circulates among attackers.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

July 2015

Stagefright (2015)

Zimperium researchers found remote code execution in Android's Stagefright media library. A single MMS could trigger it with no user action, affecting an estimated 950 million devices.

Then

Google released emergency patches, but carriers and OEMs took months to push them to phones.

Now

The episode pushed Google to create monthly Android security bulletins and press the industry toward faster updates.

Why this matters now

Like this WAP Push flaw, Stagefright was remotely triggerable through messaging with zero user interaction, and the fix depended on a fragmented update ecosystem.

May 2015

'Effective Power' iPhone text bomb (2015)

A specific text message with a malformed Unicode sequence crashed the Messages app and rebooted iPhones. The payload spread through social media and could hit any phone number.

Then

Apple released a fix for the original bug and another for a variant that resurfaced in 2018.

Now

The bug became the standard example of text-bomb denial-of-service attacks on mobile phones.

Why this matters now

The attack mechanism mirrors this one, but the vendor responses diverge: Apple patched both times, while Google classified this crash as a non-security issue.