GhostMap Android Flaw Can Trap Phones in Endless Reboot Loops Without Opening an App

A new Android bug named GhostMap can leave a phone stuck in a crash loop after a user installs a single crafted app. The app does not need to be opened, asks for no permissions, and contains no code.

Researchers at Bitdefender Labs published the findings on November 5, 2026. They have not seen the trick used against real users. The analysis began on August 12, 2026, when an APK collected in the wild crashed the lab’s test emulators. The file was a banking dropper that never ran. It failed during installation.

Bitdefender found the flaw in Android itself, not the malware. The malware author had wrapped the file with a packer, a tool that rewrites an app’s inner layout to block reverse-engineering tools. That rewrite also broke the part of Android that reads apps at install time.

GhostMap Android Vulnerability

This kind of trick is not new. Palo Alto’s Unit 42 described the BadPack method in 2024 and counted about 9,200 samples in a single year. Our earlier report on BadPack APK packers shows how those altered headers hide malware from analysts.

An APK is a ZIP file, and each entry inside it lists a compression method and a size. Two Android libraries read those fields in different ways. One library checks the size only for entries marked as stored. The other library treats anything not marked as deflated as stored. An entry with an odd method value slips between the two rules.

Android then maps the file into memory at the false size. In one test, an APK of 8,408 bytes was mapped across about 16 MB. When a process reads past the real end of the file, the CPU raises a SIGBUS fault, and the kernel kills the process.

A similar trick appeared in Konfety malware, which used unsupported compression methods to break analysis tools. Those apps still ran on the phone, though, and did not crash it.

The worst case hits system_server, the process that runs most of Android. After install, a core service reads a small resource file inside the app, crashes, restarts and reads the same file again.

The phone never finishes starting. The crash repeats every few seconds, with nothing on screen to show which app is to blame. Bitdefender tested this on a Pixel 10 running Android 17 with the August 5, 2026 patch. The first crash came about one second after install. One capture showed 110 repeats, and a safe mode run showed 72.

Safe mode fails because the service reads the file before safe mode takes effect. A factory reset works but erases local data. If USB debugging was already on, a user may delete the file through ADB, the Android Debug Bridge, between crashes.

Bitdefender lists several possible uses. A rogue app could lock a phone and then demand money. It could also damage its own icon so the launcher and Settings crash whenever a user tries to remove it.

Security scanners that open the file would crash as well, so the app might never be flagged. A harmful file could even arrive later through an app update. The bug only crashes processes. It does not run code, steal data, or raise permissions. The flaw affected range starts at Android 10.

Bitdefender reported the flaw on August 20 and again on August 25. Google first closed the case as Won’t Fix (Not Reproducible). After the second report, Google said the issue is outside the scope of a security update and passed it to a team for a possible future release. No fix or CVE exists yet. Google did patch a weaker form in 2016 as CVE-2016-6724.

Android has faced similar parsing gaps for years, including Master Key and Janus. Android also saw a zero-interaction denial-of-service flaw in the April 2026 bulletin, which shows how easily one bad file can hurt a phone.

Until Google acts, users should install apps only from trusted stores and avoid sideloaded APK files. Turning on USB debugging may help recovery, but it carries its own risks.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.