Affected Systems

Android 12, 13, 14, 15, 16, and 17. Google patched Android 14-17 in October 2026 updates, but Android 12 and 13 remain vulnerable. Flaw exists in WapPushOverSms.decodeWapPdu function in com.android.phone process.

Exploitation Status

Proof-of-concept exploit publicly available on GitHub. Zero-click remote denial-of-service attack requires only the target's phone number. Attacker can send malicious 8-byte WAP Push SMS to port 2948.

Business Impact

Remote attackers can crash Android devices, disrupt cellular connectivity, and disconnect ongoing calls (including emergency calls) with no user interaction. Victims see no visible indication of attack. Repeated exploitation can cause reboot loops requiring factory reset on some devices (Android 12 tested). Corporate BYOD and managed Android fleets on older OS versions face immediate risk. Patch availability depends on OEM and carrier distribution timelines.

Urgency

đź”´ Immediate

Recommended Actions

  • Immediately deploy October 2026 Android security updates to all managed Android 14-17 devices and verify installation with device restart.
  • Identify and isolate Android 12 and 13 devices in your environment—no patch is available; consider device replacement or OS upgrade if supported by OEM.
  • Monitor for unusual SMS-related crashes or cellular connectivity loss patterns via mobile device management (MDM) logs and user reports.
  • For devices stuck in reboot loops, use Android Debug Bridge (ADB) to remove malicious messages from SMS database before attempting recovery (technical guidance available from researcher Sakis on GitHub).
  • Coordinate with carriers and OEMs to confirm patch deployment schedules for corporate device models, especially those outside Google Pixel lineup.