Zero-click silent remote Android DoS flaw
The gist
Independent researcher Mark Blaszczyki published a proof-of-concept for a zero-click Android SMS denial-of-service flaw after Google closed it as Won't Fix.
The bug can force a factory reset, and Australia's rules on phones that can't call emergency services raise the stakes.
How it unfolded
- May 5, 2026Blaszczyki reported the zero-click WAP Push SMS denial-of-service flaw to Google through the Android & Google Devices VRP, providing a fix the same day.
- Jun 20, 2026Google assigned the report, then closed it as "Infeasible".
- Oct 29, 2026Google issued a final "Won't Fix" decision, classifying the issue as a "Non-Security Issue".