A flaw in Android’s handling of WAP Push messages can allow a specially crafted data packet to disrupt a phone’s calling functions without the user opening or even seeing a message. The attack is classified as a denial of service, and the sender needs only the recipient’s phone number, according to the technical documentation described in the report.
The message does not appear in the messaging app or show a sender. Instead, the phone processes it silently on arrival. A malformed header can trigger an internal calculation error, causing Android’s phone process, com.android.phone, to close.
That can end an active call and leave the device without mobile service for several seconds as the software attempts to restart. Because a network may resend a message when it does not receive confirmation, the disruption can persist. In severe cases, the message may remain stuck in memory and cause repeated restarts, preventing calls, including calls to emergency services such as 112.
The flaw traces back to WAP Push, an older protocol once used by mobile operators to configure internet connections and deliver multimedia links to early flip phones. Although the technology is outdated, the code that handles it remains in Android’s telephony libraries.
Google included a fix in Android’s October 2026 security patch. The update is intended to handle the error without crashing the phone and remove the message from memory. Availability depends on how quickly manufacturers such as Xiaomi, Samsung and Oppo distribute the patch.
To check the security patch level, open the phone’s settings and look under “About phone” or a similar section. Devices with the October 1, 2026 patch level or later have the fix; phones with an earlier level need to wait for an update.
Sources: Xataka Móvil.