points by throwa356262 19 hours ago | 0 comments
Is this AI security slop or a real issue? Can the phone actually receive these kind of messages from the network?
Also, I don't understand Googles position here. On android the phone ia not part of the OS and can be updated via an app or framework update. Why not just fix this as a functional bug?
[–] MarkBlah 18 hours ago
Slop and real issue. Wap-push is a legacy format for sending urls via sms. Bug is a stupid one but it exists.
Google are rather vague in their triage, they just said temporary DoS does not qualify, then rejected to investigate further.
https://android.googlesource.com/platform/frameworks/opt/tel...
It's assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We've had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:
https://grapheneos.org/releases#2026072900
Google mishandled the issue report. There was likely an internal miscommunication and they handled the report incorrectly. It's possible the issue was already filed internally and they meant to close it as a duplicate instead of WONTFIX. Closing it at all may have been an error.