GhostMap: installing one Android app can cause an unfixable boot loop, no patch from Google

Bitdefender Labs disclosed on 5 November 2026 a flaw it calls GhostMap: an Android app that contains no code and asks for no permissions can put a phone into a crash loop just by being installed, and the loop survives a reboot and safe mode. Bitdefender says it affects Android 10 and later, that Google has so far declined to fix it through a security update, and that it has not seen it used in the wild. There is no CVE number in any source we could open.

Key points

• GhostMap makes Android map an APK file entry across memory that was never allocated, so a process that reads it is killed with SIGBUS, per Bitdefender's report.
• A demonstration app with no code and no permissions, never opened, sent a Pixel 10 on Android 17 (August 5, 2026 patch) into a loop that began about a second after installation, according to BleepingComputer.
• Recovery means a factory reset, or deleting the file with ADB, which works only if USB debugging was already on and the commands run before the next crash.
• Bitdefender reported it to Google on 20 and 25 August 2026. Google first closed it as "Won't Fix (Not Reproducible)", then said it would not be fixed through a security update and passed it to a feature team.
• Bitdefender has not observed exploitation. It says the affected range is Android 10 and above.

What to do

Who is affected. Bitdefender says all Android versions from Android 10 up, and its tests used a fully patched Pixel 10 on Android 17 with the 5 August 2026 patch. No fix exists to install, because Google has not issued one.

What you can do today.

• Install apps only from sources you trust and avoid sideloading unknown APK files. Installation is the trigger, and Bitdefender says the only chance to block the attack is during installation.
• Keep a current backup. The recovery that works for everyone is a factory reset, which erases local data.
• If you manage devices, consider turning on USB debugging only where policy allows. It is the one condition under which Bitdefender says the file can be removed with ADB, but even then the commands have to race the crashes, so do not treat it as a safety net.
• Security apps may warn about a crafted file. Bitdefender detects it as Android.Riskware.Ghostmap.rA, and says a scanner can tell a crafted file by inspecting its structure. BleepingComputer's reading of the report is that such tools can display a warning but lack permission to block installation.

How to tell if you hit it. The phone never finishes starting: the core system_server process dies and restarts every few seconds, per the report, with nothing on screen to say which app is responsible.

What happened

Bitdefender began investigating on 12 August 2026, when an APK collected in the wild crashed the emulators in its analysis infrastructure. The sample was a banking dropper that never ran. It crashed during installation because a packer, a tool that rewrites an APK's internal structure to defeat reverse engineering, produced a file that also broke the Android component that parses apps at install time. Bitdefender says nothing suggests the malware author knew it would crash anything.

The researchers found the cause in Android itself: the operating system mishandles two fields inside a ZIP entry, the compression method and the declared uncompressed length. The two Android libraries involved interpret the compression method differently, which lets a malformed APK get past size checks and be mapped beyond the real contents of the file, BleepingComputer reports. Reading that entry then triggers SIGBUS in whatever process touches it.

The installer crash was a failed install and nothing more. Bitdefender then built something worse and says that escalation is its own work: an APK that installs successfully but contains a resource that system_server automatically reads. The read crashes the process, Android restarts it, it reads the same resource again and crashes again.

Background

Bitdefender notes that Google has dealt with a milder version of this kind of problem before. CVE-2016-6724, from the November 2016 Android bulletin, was a denial of service in the Input Manager Service that could make a device continually reboot. Google rated it Moderate because it was temporary and needed a factory reset to fix, and fixed it across Android 4.4.4 to 7.0, per the report.

The disclosure timeline, from Bitdefender:

• 12 August 2026: the crashing sample is found.
• 20 August: first report to Google through the Android and Devices Vulnerability Reward Program, closed soon after as "Won't Fix (Not Reproducible)" and described as out of scope.
• 25 August: an expanded second report with a working proof of concept. Google's second answer was that it will not be addressed through a security update and was referred to a feature team for possible consideration in a future version.
• 5 November: public disclosure.

BleepingComputer says it asked Google about the fix status and had no reply when it published. Sources differ in wording on Google's position: BleepingComputer says Google reserved the issue for consideration in a future update, Android Authority says the report was forwarded to the relevant team for review with no fix available, and Infosecurity Magazine says Google has so far failed to address it. All agree that no patch exists. We have not seen a statement from Google itself.

The numbers

In BleepingComputer's account of the tests, the crash sequence began about one second after installation and repeated this many times before the researchers stopped:

Normal boot110

Safe mode72

system_server crash cycles in Bitdefender's Pixel 10 test (crashes)

	crashes
Normal boot	110
Safe mode	72

Source: BleepingComputer, citing Bitdefender

These are counts from one test device and one demonstration app, not a measure of how often real devices would be hit.

What it means

For users the risk today is a targeted or malicious-app scenario, not a mass outbreak. Bitdefender explicitly says it has seen none of the abuse cases. The practical exposure is a hostile APK that a person is talked into installing.

For defenders and app-store operators Bitdefender lists scenarios it considers theoretical: bricking a phone as a lever for extortion, making a malicious app impossible to remove because its icon resource crashes the launcher and Settings, crashing security tools and analysis sandboxes that parse the same file, and delivering the malformed file in a later app update so the app passes store checks first. These come from its report, as hypotheticals.

For Google the question is scope. Bitdefender's argument is that the issue is a system-wide denial of service reachable by an unprivileged app, and it points to the 2016 precedent rated Moderate. Google's position, as relayed, is that it falls outside the scope of a security update. Android Authority adds that the public report may increase pressure for a fix, which is its opinion.

What we don't know yet

• Whether Google will ship a fix, and when. We found no statement from Google.
• A CVE identifier. None is listed in the sources we opened.
• Whether Android 17 beyond the tested Pixel 10, and other manufacturers' builds, behave identically. Bitdefender says Android 10 and above is affected, based on its testing.
• Whether anyone is exploiting it. Bitdefender has seen none of the scenarios in the wild.
• Whether third-party mitigation can reliably stop installation. Bitdefender says other tools do not have permission to block it.

What to watch next

Watch Google's Android security bulletins for any mention, the response BleepingComputer is waiting on, and whether other security vendors add detections. If you run mobile analysis pipelines, check how they handle malformed APK entries, since Bitdefender says parsing apps built on Android's native APIs crashed when reading the file.

Our earlier piece on zero-day and n-day exploits and how to keep your phone safe covers general phone hygiene.

Sources

• GhostMap: The Android flaw that crashes your phone before you open the app, Bitdefender Labs (primary)
• GhostMap Android flaw lets malicious app trigger persistent boot loop, BleepingComputer
• Android GhostMap flaw could leave phones stuck in crash loops, Android Authority
• GhostMap Bug Leaves Android Phones Stuck in Reboot Loop, Infosecurity Magazine