The Android SMS of Death bug lets someone knock your phone offline with a hidden text message you never see. If your phone runs Android 14 or newer, installing the November 2026 security update (patch level 2026-11-01 or later) closes the hole. If you’re on Android 12 or 13, there’s no fix yet.
Here’s what you need to know, who’s at risk, and how to check your phone right now.
The short version:
- It’s a zero-click bug: an attacker only needs your phone number.
- Hidden messages can drop calls, cut mobile service, and in bad cases trigger a reboot loop.
- Android 14, 15, 16 and 17 are fixed at patch level 2026-11-01 or later.
- Android 12 and 13 have no official fix from Google.
- A public proof-of-concept exists, so don’t wait on this one.
That last point is why this deserves five minutes of your time today, even though the bug can’t steal your data.
How the Android SMS of Death bug crashes your phone
The attack uses WAP Push messages, a special kind of hidden SMS that never shows up in your inbox. Android’s telephony code reads a length value in the message without checking it, which causes a memory read error, according to Ciphers Security’s technical write-up of CVE-2026-58882.
The result isn’t a hack. It’s a crash. Each bad message can drop active calls, including emergency calls, and knock out mobile service for a second or two. Security researcher Mark Blaszczyk found that around 20 messages in quick succession can push a phone into an endless reboot loop, Ubergizmo reports.
It gets worse because the bad message can stay queued. Your phone keeps retrying it, and carriers may keep redelivering it. The researcher saw outages last up to a week in testing.
The bug doesn’t allow code execution or data theft, per the same write-up. It’s a nuisance that can turn into a real emergency if you can’t make a call.
Which Android versions are patched?
Google rated the flaw Critical in its November bulletin. Here’s where each version stands, based on Ciphers Security’s November 4 update.
| Android version | Fix status | What to do |
|---|---|---|
| Android 14, 15, 16, 16 QPR2, 17 | Fixed at patch level 2026-11-01 or later | Install the November 2026 update |
| Android 12 and 13 | No fix from Google; same code is present | Upgrade the phone if you can, or replace it |
| Pixel and Samsung models | Depends on each maker’s rollout | Check for updates weekly until it lands |
| GrapheneOS | Fixed in security previews since July 2026 | Update to the latest build |
Some October builds may already include the fix. Only 2026-11-01 or later is guaranteed, though, so aim for that date.
Not sure what else the November release fixes? Our Android November 2026 security update guide covers the rest, and the Samsung November 2026 security update post covers Galaxy phones.
How to check your security patch level
It takes under a minute, and you don’t need any special tools:
- Open Settings and tap About phone.
- Tap Android version.
- Look at the Android security update line.
- If it says 2026-11-01 or later, you’re covered.
If the date is older, go to Settings, then System, then Software update, and install whatever’s waiting. Samsung phones keep this under Settings, then Software update, then Download and install.
Running a work phone? IT teams can set a minimum patch level of 2026-11-01 in their device management tool, as Ciphers Security suggests.
What if your phone is stuck in a bootloop?
Don’t rush into a factory reset. It wipes your phone and doesn’t patch the bug, so the bad message can come right back.
Contact your phone maker or carrier first. One write-up describes a technician-only ADB workaround that clears the stuck messages, but it’s untested, so leave it to a professional. Android’s Rescue Party feature may also push you toward recovery mode and offer a reset. If that happens and you need your data, stop and get help.
Meanwhile, back up your phone while it still works. A fresh backup turns a bootloop from a disaster into an annoyance.
Frequently Asked Questions
Can the SMS of Death steal my data?
No. According to Ciphers Security, it can’t run code or steal data. It only crashes phone services and can cause reboot loops.
Do I have to open the message?
No. The message is hidden and arrives in the background, so you won’t see it or tap anything. That’s what makes it zero-click.
Is my Android 13 phone safe?
Not right now. Google hasn’t released a fix for Android 12 or 13, and no maker backport has been announced. Upgrading to a newer Android version is the only reliable protection.
Is anyone actually attacking phones with it?
Reports differ. Ciphers Security says no real-world attacks had been confirmed as of November 4, but a public proof-of-concept app exists. Treat it as urgent anyway.
Does turning off SMS help?
The sources don’t describe a reliable switch-off option, and carrier-level filtering hasn’t been announced. Updating is the fix to rely on.
Our take
If your phone runs Android 14 or newer, check the patch date today and install the update tonight. It’s a one-minute job against a bug that can take your phone offline for days. If you’re on Android 12 or 13, treat this as a sign it’s time to plan an upgrade, because bugs like this one won’t get fixes on your phone.
Leave a Reply