A GhostMap Android flaw lets a malicious app trap phones in a boot loop with no permissions

A banking malware sample that kept crashing Bitdefender’s analysis emulators led researchers to a flaw in Android that can put a phone into an endless restart cycle. The bug, named GhostMap, is triggered by installing a crafted app that asks for no permissions, contains no executable code and never has to be opened. Bitdefender published the research on Nov. 5.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

The company reproduced the problem on a Pixel 10 running Android 17 with the Aug. 5, 2026 security patch, and says the weakness sits in base Android code and reaches back to Android 10. Google has told the researchers it does not plan a security fix.

Alecsandru Cătălin Daj of Bitdefender Labs’ mobile security and forensics unit wrote the technical GhostMap analysis. It describes a parser differential, meaning two Android libraries read the same ZIP data and disagree about it. Each entry inside an APK declares a compression method, and Android supports only stored and deflated. One library checks a declared size against the file only for stored entries, while the other treats anything not deflated as stored and maps memory at the declared size.

A compression-method value that slips between two checks

An entry carrying an unsupported method value passes both checks. The kernel allows the oversized mapping, and the first read beyond the real end of the file raises a SIGBUS error that kills the reading process. Bitdefender’s test APK was 8,408 bytes but was mapped across roughly 16 MB.

The original banking dropper only failed during installation. What the team showed is that the same malformation can be aimed at a file that a core system service reads after installation. If that process is system_server, the phone crashes and restarts it every few seconds.

The finding builds on earlier work. Stahie noted that research from Zimperium described malformed APKs that crashed analysis tools and resisted decompilation but still ran on devices. GhostMap differs because the malformed file does not need to run at all: a system service trips over it, and the phone is stuck before any user-facing app can start.

Why a crash loop behaves like a boot loop

BleepingComputer called it a persistent boot loop, while Bitdefender’s own wording is crash loop. The distinction is small for an owner: the phone stays on the boot animation, and one capture showed 110 restart cycles. Rebooting does not break the cycle, and safe mode runs the same loop because the crash happens before safe mode takes effect.

Recovery generally means a factory reset, which erases local data. Removing the file over ADB is possible only in limited cases where USB debugging was already switched on. Bitdefender argues that a condition needing a factory reset deserves a High severity rating under current guidelines.

Silviu Stahie, a Bitdefender security analyst, told Help Net Security that the flaw is present in AOSP, the open-source base of Android, and was tested from Android 10 onward. Because it lives in the base code, the team did not test other manufacturers’ handsets individually.

Installing is the only user action required, according to Bitdefender, and the app never has to be launched. The research does not say how such a file would reach a phone, and it does not rule out any route. Its published guidance stops short of fixes, because on an unpatched phone the only tools are the vendor’s detection and caution about where apps come from.

Google’s response and the missing CVE

Bitdefender sent its first report on Aug. 20, and Google closed it as “Won’t Fix (Not Reproducible).” A follow-up on Aug. 25 with a working proof of concept drew a different answer: the issue fell outside the scope of a security update, and Google forwarded it to a team for possible inclusion in a future Android version. Bitdefender told Google at the end of October that it would publish on Nov. 5, and Google agreed.

No CVE identifier exists for GhostMap. Stahie attributed that to Google declining to accept the bug through its vulnerability program. Bitdefender points to CVE-2016-6724, a 2016 Input Manager Service reboot flaw rated Moderate, as a weaker earlier version of the same kind of defect.

Bitdefender has not seen the technique in real attacks. Its Mobile Security product detects the malformed files as Android.Riskware.Ghostmap.rA, but Android does not let third-party apps block installs or remove other apps, so owners have to act on the warning themselves. Android Authority and other outlets reported the same facts.

The disagreement over severity is the practical story. Google judged the bug outside the scope of a security update, while Bitdefender argues that any flaw a zero-permission app can use to force a data-erasing reset belongs in the High tier. Without a CVE, defenders have no common identifier to track the issue across advisories or scanners, so the Bitdefender detection name is the main marker for now.

The open question is whether Google Play review would catch such a file. The research does not test that, and without a patch the answer decides how far the risk extends beyond sideloaded apps.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.