Mark Blaszczyk Reveals Android Vulnerability Causing Crashes
An Android software vulnerability tracked as CVE-2026-58882 can disable cellular call functions and trigger device crashes through a single incoming message, according to security researcher Mark Blaszczyk. The flaw impacts Android 12 and later versions, allowing attackers to target devices without requiring user interaction such as opening a file or tapping a link.
Technical Mechanics of the Vulnerability
The mechanism exploits how the operating system handles WAP Push messages. The system attempts to convert a message header length value of 2,147,483,648 into a smaller data type. Because necessary boundary checks are missing, a number overflow occurs, transforming the value into negative 2,147,483,648. This negative integer crashes the system component responsible for managing phone calls.
Active phone calls, including emergency services connections to numbers like 911, can be abruptly terminated during an attack. The vulnerability prevents users from noticing the incoming transmission because the notification does not appear in the standard inbox.
Malicious Messages Can Trigger Continuous Restart Cycles
Repeated transmissions can push a vulnerable handset into a continuous restart cycle, or bootloop. When the device fails to report delivery back to the carrier, the network operator attempts to resend the message, leaving it trapped in the pending queue. Approximately 20 malicious messages are enough to render certain units unusable, requiring technical intervention or connection to a computer to manually clear the queue.
Blaszczyk tested the exploit successfully on a Google Pixel 9 and various Samsung Galaxy A series devices running April 2026 security software. Google Pixel and Samsung Galaxy models are confirmed among the affected hardware.
Google Prepares Patch After Initial Risk Assessment
Blaszczyk reported the flaw to Google on May 5, 2026. Initial corporate assessments declined to classify the issue as a security risk, though engineering teams subsequently prepared a fix. Android code records show a patch was ready by June 15, and GrapheneOS stated that fixes were distributed through July security previews.
Google incorporated the fix into October updates for Android versions 14 through 17, and the mitigation is expected to feature formally in the November Android Security Bulletin. The updated software detects potentially harmful messages and deletes them directly rather than attempting to process them.
Devices running Android 12 and Android 13 remain in an uncertain position regarding official updates from individual manufacturers. Users on Android 14 and newer builds are advised to check system settings for available security patches.