Zero click, silent, remote Android DoS

The page describes a zero-click Android denial-of-service flaw in WAP Push SMS handling. In `WapPushOverSms`, Android reads a message’s header length as a large unsigned value, casts it to a signed integer without checking its range, then uses it to allocate an array. A crafted five-byte value becomes a negative size, triggering an uncaught exception that crashes the `com.android.phone` process. The data message is not displayed, so the recipient sees neither a notification nor the sender. The reported effects include dropped active calls, including emergency calls, brief losses of service, and repeated crashes when carriers redeliver unacknowledged messages. The disclosure says rapid repeated delivery can also corrupt the SMS database, leaving telephony crashing on every boot; recovery may require stopping redelivery by moving a physical SIM to another device and clearing records through ADB.

The author reports reproducing the crash on multiple Pixel and Samsung models and argues that loss of emergency calling makes the flaw a serious public-safety risk, especially in Australia, where affected phones may be barred from carrier service. A proposed fix checks the raw length against the message size before casting. The vulnerability was reported to Google in May 2026, but after appeals and further evidence, Google classified it as a non-security issue and declined to fix it. The page says disclosure followed the 90-day process and publishes source code and an APK for authorized testing, warning that the proof of concept can disrupt or disable phones.