Android Vulnerability Causes Telephony Service Crashes
A zero-click exploit in Android devices triggers system crashes through malformed WAP Push messages.
Updated on Oct. 29, 2026 in Cybersecurity
Live Poll
Do you trust that smartphone manufacturers adequately address security flaws reported by researchers?
As of April 2026, researchers have identified a zero-click vulnerability in the WapPushOverSms.decodeWapPdu Android code that causes telephony service crashes. This exploit allows a single malformed WAP Push message to force the com.android.phone process to terminate.
Why it matters
The vulnerability affects both Pixel 9 and Samsung Galaxy devices, leaving users without service for one to two seconds per incoming malicious message. Because Google has designated this flaw a non-security issue, it remains an unresolved concern for affected users.
The exploit utilizes the byte sequence 88 80 80 80 00 to trigger an array allocation error, resulting in a converted integer value of -2147483648. Roughly 30 such messages can cause permanent SQLite database corruption.
The players
Google is the primary developer of the Android operating system and maintains the ecosystem for Pixel devices.
The details
The vulnerability stems from a lack of range checking when the system converts a message header length to a signed integer. Victims may face persistent issues as factory resets do not block carriers from resending the payload, though moving a SIM card to an iPhone has effectively cleared the database corruption.
Timeline
Researcher testing of the vulnerability on Pixel 9 firmware occurred in April 2026.
The Tech Race
The reliance on the legacy WAP Push messaging protocol continues to create security gaps in modern smartphone operating systems. This discovery highlights the ongoing challenge of securing older network-dependent standards against zero-click exploits in the mobile tech race.
Users of Pixel 9 and Samsung Galaxy devices may experience unexpected service outages if they are targeted by this exploit. Currently, the only effective workaround for persistent database corruption involves moving the SIM card to a non-Android device.
The takeaway
Users should be aware that mobile devices remain susceptible to service interruptions via legacy messaging protocols. Security researchers recommend staying vigilant regarding unexpected incoming messages as these vulnerabilities currently lack vendor-provided patches.
Further reading
Learn more about mobile safety protocols in the Cybersecurity section.
Live Poll
Do you trust that smartphone manufacturers adequately address security flaws reported by researchers?
