2 NOV 2026 — A researcher has published a working exploit for an Android flaw that lets one hidden text message crash a phone's calling service and cut emergency calls.
Google's public code shows a fix for Android 14 to 17 and none for Android 12 or 13. By our count, those two older versions made up between 10.32% and 23.36% of Android phone web traffic in six ASEAN markets last month.
Android 12 and 13 across ASEAN
We pulled StatCounter's Android version figures for October 2026 for each market, on its phones-only setting, and added the two columns ourselves.
| Market | Android 12 (%) | Android 13 (%) | 12 + 13 (our sum, %) |
|---|---|---|---|
| Philippines | 8.18 | 15.18 | 23.36 |
| Vietnam | 8.70 | 13.88 | 22.58 |
| Indonesia | 8.83 | 11.40 | 20.23 |
| Thailand | 7.14 | 9.15 | 16.29 |
| Malaysia | 5.90 | 8.82 | 14.72 |
| Singapore | 4.57 | 5.75 | 10.32 |
These are shares of web traffic, not installed phone counts. StatCounter counts page views on sites carrying its tracking code, so heavy users weigh more and a phone that stays offline does not appear. The figures can also be corrected for 45 days after publication. We used only the 12.0 and 13.0 rows. StatCounter's small 12.1 to 12.3 rows would add 0.29 points in Singapore and no more than 0.05 elsewhere.
A message nobody sees
A researcher who signs as Mark B disclosed the flaw on 29 October in a writeup at smsofdeath.com. We have not linked to that page because it also offers the exploit. The researcher says Google was told on 5 May. Android reads a length value in a malformed message without checking its range, and the resulting error kills the process that runs calls and mobile service.
The victim taps nothing and sees nothing in Messages. By the researcher's account, each message costs a second or two of service and any call in progress drops. A burst of them can make a phone unusable for an extended period, the writeup says, because the stored messages are retried at every boot. One Android 12 phone fell into a reboot loop, and getting out takes a computer or a factory reset.
This is a denial of service: it knocks a phone off the network without reaching its data, and we read no report of anyone using it against real victims. The researcher reproduced the crash from Android 12 upward. We make no claim about Android 11 or older.
Missing from Google's October bulletin
The researcher says the fix shipped in October's update. BleepingComputer and Android Authority number the flaw CVE-2026-58882, but a search of the raw text of Google's October bulletin finds no such entry, and the bug number on the fix is absent too. The MITRE and NIST vulnerability databases returned no record of it when we checked on 2 November.
The fix itself is public, authored by an Android engineer on 15 June. It catches the error and deletes the offending message. We read the same file on Google's public security branches, where the change appears from Android 14 up. It is absent from 12, 12L and 13, but those branches last moved in 2022 and October 2025, so they cannot show what a manufacturer may have added on its own.
We found no Google statement on any of this. The Android 12 and 13 status rests on the researcher, BleepingComputer's report and our branch check. Android Authority, which asked Google for the patch timeline, relays a GrapheneOS claim that the flaw is due in November's bulletin. That bulletin was not online when we looked.
What you can check: in Settings, About phone, then Android version, shows your version and security update date. The researcher says an October 2026 patch level or later is protected, and a newer Android version alone proves nothing because delivery varies by device. What you cannot do: on Android 12 or 13 we found no update to install, and no source offers a setting that blocks the message.
View author profile → · Editorial policy
