01.09.2026
3 min
276
Bitdefender researchers have discovered a vulnerability in Android called GhostMap that can render a smartphone unusable simply by installing a specially crafted app. The app does not even need to be opened or granted any permissions, yet it can trap the device in an endless reboot loop that even Safe Mode cannot resolve.
According to Bitdefender Labs researchers, the GhostMap vulnerability affects all Android versions starting with Android 10. Researchers successfully reproduced the issue even on a Google Pixel 10 running Android 17 with the August 5, 2026 security update. An attacker only needs to install a specially crafted APK file. The file may contain no executable code, request no permissions, and never even be launched. Nevertheless, Android automatically processes its resources, potentially causing a critical system process to crash.
After the crash, the system attempts to restart the process, but it accesses the corrupted file again and crashes once more. This cycle repeats indefinitely, preventing the smartphone from booting normally. A regular restart does not resolve the issue, and Safe Mode also fails to eliminate the problem. In the worst-case scenario, the only reliable recovery method is a factory reset, which erases locally stored user data.
GhostMap is linked to improper handling of ZIP archives, which form the basis of APK installation packages. Android uses two system libraries, libziparchive and libandroidfw, that interpret information about compression methods and file sizes within an archive differently. An attacker can manipulate these values to make the system attempt to read more data than the file actually contains. In one experiment, researchers created an APK just a few kilobytes in size that caused Android to map approximately 16 MB of memory.
Rather than copying the entire archive into RAM, Android maps the file into its virtual address space. If the declared size exceeds the actual file size, part of the mapped region has no corresponding data on disk. When the system attempts to read this nonexistent data, a SIGBUS error occurs. The Android kernel then forcibly terminates the process that accessed the unavailable memory region.
The situation becomes particularly dangerous when the corrupted resource is processed by system_server, one of Android’s core system processes. After it crashes, the operating system restarts the process, but it reads the problematic file again and triggers another crash. As a result, the smartphone may become stuck on the boot screen, making it impossible to access the normal user interface.
The investigation began on August 12, 2026, when Bitdefender researchers noticed unusual behavior in a malware sample associated with banking attacks. The APK file caused Android emulators to crash during installation attempts. Initially, researchers suspected that the issue was related to the malicious application itself. However, further analysis revealed that the crashes resulted from a flaw in Android’s APK processing mechanisms.
The sample used a packer that modified the application’s internal structure to make reverse engineering more difficult. These modifications inadvertently triggered improper file processing. According to the researchers, the malware author was likely unaware of this behavior. The original sample merely disrupted the installation process without causing a persistent crash loop.
Later, the Bitdefender team developed a separate proof-of-concept APK that installed successfully but caused the system process to crash repeatedly. This experiment confirmed that the vulnerability could completely disable a smartphone.
GhostMap is not limited to endless reboot loops. Researchers found that corrupted APK resources can cause various Android components to crash, depending on which process attempts to handle them. For example, manipulating an application’s icon size could theoretically make it nearly impossible to uninstall through normal means. Attempting to open the app list or the corresponding settings section may cause a system component to crash.
The same issue affects security tools. If an antivirus or APK analysis application uses vulnerable system mechanisms to read the file, it may also crash. Another potential scenario involves distributing the problematic file through an update to an already installed application. In this case, the malicious component could theoretically be introduced after the app’s initial security checks, creating a risk of simultaneously affecting a large number of devices.
At the same time, GhostMap does not directly enable data theft, privilege escalation, or arbitrary code execution. Its primary danger lies in denial-of-service attacks, which can render a device or individual system components unavailable. Researchers also suggest that a similar mechanism could be used for extortion, with attackers threatening to disable smartphones and cause users to lose locally stored data. However, there have been no confirmed cases of GhostMap being used in such attacks.
Bitdefender reported the issue to Google twice through the Android & Devices Vulnerability Reward Program. The first report was submitted on August 20, 2026. Google closed it with the status Won’t Fix (Not Reproducible), stating that the reported issue did not meet the program’s requirements.
Following additional experiments, researchers submitted a second report on August 25, this time providing evidence that the vulnerability could trigger a persistent crash loop. However, Google again declined to release a dedicated security update, classifying the issue as outside the scope of the relevant security-fix process. Nevertheless, the company forwarded the information to the appropriate team for consideration of a possible fix in future Android versions.
As of November 5, when the research was published, no fix for GhostMap was available. Cybernews journalists contacted Google for comment, but the article did not include a response from the company.
Because the vulnerability exists within Android itself, protection options remain limited. Researchers recommend avoiding suspicious APK files, particularly those downloaded from third-party websites or unknown sources. Mobile security tools can detect malformed APK files before installation. For example, Bitdefender Mobile Security identifies such files using the Android.Riskware.Ghostmap.rA detection signature and warns users about the threat.
However, due to Android’s security restrictions, third-party antivirus applications cannot independently block the installation of another app or uninstall it. Users must therefore act on security warnings before the system begins processing the malicious resource.
If a smartphone has already entered a crash loop, Android Debug Bridge (ADB) may help in some cases. USB debugging must have been enabled beforehand, and the problematic file must be removed between system process crashes. After a complete kernel reboot, this method may also become ineffective because the crash occurs at a very early stage of Android’s startup process. In that case, a factory reset may be the only remaining option, resulting in the loss of any data that was not backed up.
GhostMap has not yet been observed in real-world attacks, but researchers have already demonstrated that it can completely disable a smartphone without executing malicious code. Until a fix becomes available, users should be especially cautious when installing applications and regularly back up important data.
