,regionOfInterest=(1187,450)&hash=a1c036a49414ceb7c9f7b1e288a0c9ed5449a1a77f1ac1f9381fe1f58b2604d4)
A single invisible WAP Push message can crash Android 12 through 17 devices, triggering endless 90-second reboots and data-wiping prompts, according to findings published by security researcher Mark Blaszczyk.
How the WAP Push Exploit Crashes Android Phones
The flaw targets the telephony service com.android.phone through an unvalidated typecast in the WSP header. When a phone receives the malformed message, the parser converts a manipulated length value into a negative array size. This triggers an unhandled NegativeArraySizeException that cuts off active phone calls and emergency lines instantly.
The attack remains entirely invisible because the messages never appear in the device inbox. WAP Push is a legacy carrier protocol designed for sending behind-the-scenes instructions to mobile phones without user interaction. Blaszczyk discovered that Android tries to reprocess the malicious payload upon every reboot, trapping the device in a continuous crash loop. Receiving roughly 20 such messages can render a handset practically unusable. Because mobile operators automatically resend unacknowledged messages, a single initial text can sustain disruptions for up to one week.
Google Patches Vulnerability for Android 14 Through 17
Google assigned the flaw CVE-2026-58882 after Blaszczyk reported the issue on May 5. Developers generated a correction on June 15, checked it in on August 5, and moved it to the Android Open Source Project in October. GrapheneOS independently integrated a fix back in July after Google provided it via security previews. Google released a formal security patch for Android versions 14 through 17 in October.
Older devices running Android 12 and 13 will likely not receive official patches unless individual hardware manufacturers build their own fixes. Users running supported software versions can check for the update by opening device settings and navigating to system software updates.
Why Users Must Avoid the Data Wipe Prompt
Unsuspecting users trapped in the reboot loop face a recovery screen demanding a factory reset to restore functionality. Choosing the wipe option deletes all stored personal data permanently. Blaszczyk advised affected owners to connect their phone to a computer running the Android Debug Bridge developer tool instead of wiping the device. Device owners without a Google Pixel smartphone often wait weeks or months for manufacturers to distribute newly issued security patches.
