[REVISION HISTORY]

Messaging app and mobile security vulnerabilities

3 recorded revisions of this situation.

What changed

2026-10-31 08:25 UTC → 2026-10-31 17:06 UTC · added ~~removed~~

Security researchers have identified several critical vulnerabilities across major messaging platforms and mobile operating systems. In the Signal messaging app, researchers found that macOS encryption keys were stored in plaintext alongside encrypted databases. This flaw, combined with unencrypted storage of attachments, could allow spyware to access sensitive data or clone installations without triggering warnings. Additionally, a vulnerability in Signal’s RingRTC calling library, designated CVE-2026-113380, could lead to a denial-of-service condition where audio or video channels remain active after a user attempts to end a call. Signal released version 2.72.0 to address the calling library issue. Regarding Android, a remote code execution vulnerability was discovered in the Telegram app. Attackers could execute arbitrary code by making a standard voice call that exploits how the app processes MediaState data. Telegram patched this in version 12.10.4. Furthermore, a zero-click denial of service vulnerability, referred to as the “SMS of Death,” was identified in the Android operating system. Tracked as CVE-2026-58882, the flaw allows attackers to disrupt mobile services by sending a specially crafted WAP Push message. Because the vulnerability resides in how the system processes message header lengths, the malicious message does not appear in the user's inbox and requires no interaction from the recipient. The exploit can cause the “com.android.phone” system process to crash, leading to dropped calls, including emergency services, or even a device bootloop. This issue has affected Google Pixel and various Samsung Galaxy devices. Google has released security updates for Android versions 14 through 17, but devices running Android 12 or 13 may remain vulnerable while awaiting manufacturer-specific patches. Security researcher Mark Blaszczyk noted that receiving approximately 20 such messages can render a device nearly unusable.

Versions

Select a version to see what changed compared to the one before it.