MarkBlah

triage seems outsourced for android, messages like "we will forward this to the android team". This seems to have been a communication issue, they set it as Will Not Fix, they 'fixed' the bug by adding try/catches further up the chain in upcoming release, i missed that before i submitted.

they did set it as a duplicate of a ticket they disregarded.

I found the Chrome team the easiest to communicate with, devs would actually respond.

page updated to reflect.

I’m not going to sit there ensuring css aligns right so ofcourse I automated that, the content is all accurate, it was reworded by LLM, bug is real.

Sounds like a you problem, I’m just sharing information that’ll hopefully force Google’s hand in fixing a bug.

App dies mid write corrupting db, code is available for review, it’s small.

I’m certain others have found the same bug, I’d like an answer too, hence the post.

A wordpress page would be more believable, right?

I guess if you just use the torch on your android phone then it wouldn’t be serious.

You sound like android triage team.

Apk provided can be installed on an attackers phone, you specify the msisdn (phone number) of victims phone, click send and it crashes telephony app of the victim.

Multiple messages may create a race condition that corrupts an SQLite database that stores message which stops telephony from functioning as a phone. WiFi will still work so I guess you can use it as a tablet as long as you don’t mind the constant dialogs popping up.

Tested in AU, US, DE and UK with 100% success rate.

To recover I deleted the telephony.db, 2 minutes later carrier resent the messages…

Only fix is to place sim/esim into non Android device

Huh, Yes victims phone number, bug is in android. Carriers just send messages.

Load apk, select which sim you want to use, enter Android victims phone number, hit send, it will crash telephony app and it’ll restart.. carrier will resend the text message as there was no acknowledgment crashing it again in a loop.

Only “fix” for this attack is to place SIM card in a non-Android phone to ack the inbound messages, or wait a few days of constant disconnects.

Ah before www, gopher was used to try arrange information, similar to this page. Prior to that there were bbs’s where you dialed up to another computer.

Slop and real issue. Wap-push is a legacy format for sending urls via sms. Bug is a stupid one but it exists.

Google are rather vague in their triage, they just said temporary DoS does not qualify, then rejected to investigate further.

wap-push is a legacy protocol, it predates mms's, android can send it fine, ios just ignores them.