Hacker News

points by 6thbit 9 hours ago | 0 comments

What confused the people dismissing this all over the comments here? It was clearly a DoS bug.

Perhaps the site's tagline was all they read and admittedly I'd have phrased differently.

  > A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls), with zero interaction from the victim.

An easier way to deliver the point across could be:

  > Anyone can send an specially crafted SMS to repeatedly crash the victim's phone app on Android without user interaction. Google didn't fix it, here's an app you can download to send that SMS and disable anyone's phone remotely.

Just my 2 cents for OP, good job on finding and reporting this and it sounds great that it was actually patched, glad you persisted through the frustration of dealing with google's triaging.

[–] grapheneos 4 hours ago

Google committed a fix on June 15th and it was shipped in the security preview patches in mid-July. GrapheneOS shipped it in our security preview releases in July. It's in the upcoming November security bulletin but a patch was pushed to AOSP in October:

https://android.googlesource.com/platform/frameworks/opt/tel...

It's assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We've had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:

https://grapheneos.org/releases#2026072900

Google mishandled the issue report. There was likely an internal miscommunication and they handled the report incorrectly. It's possible the issue was already filed internally and they meant to close it as a duplicate instead of WONTFIX. Closing it at all may have been an error.