Critical Android flaw allows calls, including emergency calls, to be cut off with an SMS

A single WAP Push message sent as a data SMS can crash Android's telephony process (com.android.phone) without any user interaction, cutting off ongoing voice calls, including emergency calls, and leaving the phone without connectivity for a few seconds, according to independent researcher Mark Blaszczyk as cited by Security Affairs. The flaw has the identifier CVE-2026-58882 and the November Android security bulletin rates it as critical, according to GrapheneOS as cited by the outlet.

Each message causes an interruption of one to two seconds, and some 20 messages can render the phone unusable for an extended period, according to Security Affairs. The researcher reproduced it on a Google Pixel 9 and on Samsung Galaxy phones.

Google's October 2026 security update fixes the flaw in Android 14, 15, 16 and 17; Android 12 and 13 may remain exposed if they do not receive a patch, according to the same outlet. There have been no reports of it being exploited in real-world attacks.

Story under review: neither the Android security bulletin nor the researcher's publication could be accessed; the information comes from a specialist outlet.