The vulnerability causes cellular connectivity issues; a fix has been included in the October security update.
Researcher Mark Blaszczyk has discovered a vulnerability in how Android handles certain service-related SMS messages. An attack can be triggered simply by the device receiving a specially crafted message—there is no need for the user to open it or click on any links.
The vulnerability relates to the processing of WAP Push service messages in Android 12 and later versions. According to GSMArena, the issue has been confirmed on Google Pixel and Samsung Galaxy smartphones.
The message is processed in the background and may not even appear in the user’s inbox. The flaw can interrupt phone calls and temporarily disable cellular connectivity. Repeatedly sending such SMS messages can lead to severe malfunctions, requiring technical assistance to resolve.
The attack requires no user interaction with the message; the mere act of the smartphone receiving it is sufficient.
As reported, a fix for Android 14 and newer versions was included in the October security update. It allows the system to delete malicious messages before they can be processed in a way that causes issues. It is not confirmed whether a fix is available for Android 12 and 13.
About the Author
