A hidden, zero-click Android message can crash the process responsible for phone service and interrupt active calls. The specially crafted WAP Push message is processed automatically and does not appear like a normal text. Repeated processing can extend the disruption and may affect calls to emergency services. The issue has been reproduced on several devices running Android versions from 12 through 17.
Why It Matters
This is an availability and safety problem rather than a data-theft claim. Google distributed a fix through the October 2026 security update for Android 14 through 17, while some Android 12 and 13 devices may remain exposed. For leaders: unsupported mobile devices can create communication and duty-of-care risks. For defenders: check patch levels and identify devices that cannot receive the correction. The larger lesson is that silent messages can attack essential device functions without stealing data or requiring a tap.
What Defenders Should Do
Apply current Android security updates and replace unsupported devices that cannot receive the telephony fix.