Zero‑Click SMS Exploit Cripples Android Calls, Including Emergency Services

A newly disclosed vulnerability, dubbed the “SMS of Death,” allows a malicious actor to destabilize Android phones simply by sending a specially crafted text message, causing the device's telephony stack to crash and blocking all voice calls, even those to emergency services.

The exploit requires no interaction from the user; the malicious SMS is processed automatically by the operating system. Once received, the message triggers a fault in the phone’s native telephony service, which manages call routing and signaling. The fault forces the service to terminate, cutting off ongoing calls and preventing new ones from being placed until the device is rebooted or the service is manually restarted.

Security researchers who first reported the issue noted that the attack vector is “zero‑click,” meaning the victim does not need to open the message, click a link, or install any additional software. The payload is embedded in standard SMS fields and exploits a flaw in how Android parses certain protocol elements. Because SMS delivery is handled at the system level, the malicious payload can bypass typical app‑sandbox protections.

Android’s dominance in the global smartphone market makes the vulnerability particularly concerning. The platform powers devices ranging from low‑cost handsets in emerging economies to high‑end flagship models. Disruption of voice services, especially emergency calling, could have serious public‑safety implications, prompting carriers and manufacturers to assess the risk for their user bases.

While the specific code path affected has not been disclosed, the vulnerability appears to be rooted in the Radio Interface Layer (RIL), which mediates communication between the operating system and the cellular modem. Similar low‑level flaws have been the target of past exploits such as Stagefright and Broadpwn, which also leveraged system components to achieve remote code execution or denial of service.

Google has not yet issued a public patch, but the company typically releases security updates through its monthly Android Security Bulletin. In the interim, security experts advise users to keep their devices updated, avoid installing unverified carrier configuration profiles, and monitor official communications from their device manufacturers for any emergency firmware releases.

Industry observers expect that the disclosure will accelerate the rollout of mitigations across Android OEMs and may influence carrier‑level filtering of suspicious SMS traffic. As the ecosystem prepares a response, the episode underscores the ongoing challenge of securing legacy communication protocols that were not designed with modern threat models in mind.