WAP Push SMS can brick Android 12+; October patch fixes

Receiving a specially crafted WAP Push SMS can render phones running Android 12 or later unusable, security researcher Mark Blaszczyk reported.

Blaszczyk says the malformed WAP Push messages target Android's telephony framework. Instead of appearing in the messaging inbox, the operating system attempts to process the payload in the background and triggers an error that disrupts core services.

The error can drop active phone calls, temporarily remove cellular service, and, when multiple messages are received, leave a device effectively unusable. Recovery can be difficult and may require technical support. The attack requires no user interaction and is not a phishing vector.

So far Blaszczyk and other researchers have observed the issue on Google Pixel and Samsung Galaxy phones, and he reports the underlying flaw exists on all devices running Android 12 or later.

The patch and its limits

When researchers reported the problem in May, Google denied it. Android?s engineering team later developed a remedy and included a fix in the October security patch for devices running Android 14 or later. Older phones running Android 13 or earlier remain vulnerable.

The implemented change is narrowly targeted: the system now recognizes one of the 20 potentially malicious messages and removes it instead of attempting to process it.

If your device runs Android 14 or later, install the October security patch as soon as it is available.

If you are on Android 13 or an earlier release there is no practical user-side mitigation beyond seeking carrier or manufacturer support; for modern handsets, check for and apply the October security update from Google.