GhostMap: an Android install-time bug that can trap phones in a crash loop

Bitdefender Labs published research on November 5 describing a flaw it calls GhostMap, which lets a specially crafted Android app crash a phone into a persistent boot loop. The app needs no special permissions and contains no executable code, since the crash happens during installation rather than when the app runs. The cause is a mishandling of the compression method and declared uncompressed length inside a ZIP entry, the format APK files are built on, which makes Android map far more memory than the file holds and crash when reading it.

The crash loop hits system_server, a core Android process, which then restarts repeatedly; neither a normal reboot nor safe mode stops the cycle. Bitdefender says recovery generally requires a factory reset that erases user data. Bitdefender reproduced the issue on a Pixel 10 running Android 17 with the August 2026 patch, and says it affects Android 10 and later.

Bitdefender first reported the bug to Google on August 20, 2026, with a detailed proof-of-concept report on August 25. Google closed the first report as not reproducible and outside the program's scope, and later said it would not get a security-update fix. As of publication, no fix exists, though Bitdefender's own security software can detect the malformed file.

Why it matters

A no-permission, no-code APK that can force a factory reset highlights a gap between Android's security program and its actual risk to users.

Source: Bitdefender