A newly disclosed Android flaw lets a specially crafted app trap a phone in a crash loop that survives restarts and safe mode. The app needs no permissions, contains no executable code and never has to be opened. Bitdefender Labs, which published the research on November 5 and calls the flaw GhostMap, says recovery usually means a factory reset that erases the phone.
Bitdefender reproduced the crash loop on a Pixel 10 running Android 17 with the August 5, 2026 security patch. It says it also reproduced the bug on releases from Android 10 onward. According to Bitdefender, Google told it the issue is outside the scope of a security-update fix. Bitdefender says no fix is available as of publication.
How the GhostMap crash loop works
Android apps ship as APKs, which are ZIP files, and two core Android libraries disagree about one unusual kind of ZIP entry. That disagreement skips a size check, so the file gets mapped into memory at a fake, oversized length. When a core system service reads the file, it crashes. The service restarts, reads it again and crashes again.
Bitdefender timed about one second from install to the first crash, and one safe-mode run looped through 72 crash cycles. Per Bitdefender, the bug doesn’t run code, read your data or gain permissions. Because the flaw sits in core Android code, other brands’ phones on Android 10 or later may also be exposed.
Found by accident, then pushed further in the lab
In August, a banking-malware sample collected in the wild crashed Bitdefender’s analysis emulators during install, with no sign its author intended that. Bitdefender’s own research then turned the glitch into a persistent crash loop.
The company sketches theoretical abuses, such as an app that crashes the screens needed to uninstall it, or one that blinds security scanners. It also describes a malformed file arriving later through an app update. On those scenarios, Bitdefender is direct: “We have not observed any of these scenarios in the wild.”
What Google said, according to Bitdefender
Google’s side comes only from Bitdefender’s account of private replies through Google’s bug bounty program. As of November 5, no public statement from Google has surfaced.
Per Bitdefender, Google closed Bitdefender’s August 20 report as not reproducible and out of scope. Bitdefender says a second report with a proof of concept followed on August 25. Google then called the issue outside the scope of a security-update fix, Bitdefender says. It reportedly forwarded the bug for possible inclusion in a future version update.
Bitdefender points to a November 2016 precedent, CVE-2016-6724. Google fixed that weaker variant as a Moderate-rated security bug that also needed a factory reset. Bitdefender argues today’s severity guidelines would rate GhostMap High. For owners, the gap is hard to ignore. A bug that can force a data-wiping reset is headed for a possible future Android version, not a security patch.
How to protect your phone from GhostMap
With no fix available yet, per Bitdefender, the practical steps are about limiting exposure. This is our advice, not Bitdefender’s:
- Be cautious with unfamiliar apps: the crash triggers on install, so think twice before installing APKs from sources you don’t know well. Since the file could also arrive in a later update, a store listing alone isn’t a guarantee.
- Keep a current backup: photos, messages and app data that live only on the phone are what a factory reset destroys.
If USB debugging was already on, a computer running ADB can sometimes delete the bad file between crashes. Bitdefender says that stops working after the first full kernel reboot. Bitdefender also says its own security app flags these files, and other security apps may too.
For a similar crash risk, see the SMS of Death flaw that can crash phones and drop emergency calls.
Source: Bitdefender Labs
This post was written with AI assistance from public sources and published under the editorial responsibility of AndroidPure’s editor. How we work.
