Security researcher Mark Blaszczyk discovered a critical vulnerability affecting Android 12 and later. It exploits specially crafted WAP Push SMS messages that the telemetry framework cannot process. Instead of appearing in the inbox, Android attempts background processing, triggering errors that disconnect active calls and cause temporary cellular service loss.
Multiple messages can render the device unusable. The attack requires no user interaction, making it particularly dangerous. Researchers have confirmed the issue on Google Pixel and Samsung Galaxy devices.
While Google initially denied the issue, a fix was included in the October 2024 security patch for Android 14 and newer. Phones running Android 13 or older remain vulnerable. The solution involves the system recognizing one of 20 malicious message types and removing them upon receipt rather than processing them.
Users of modern handsets should check for and install the latest security update to mitigate the risk.
Source: GSMArena · Summarized by HeadlinesBriefing