Bitdefender Labs has disclosed GhostMap, an Android flaw that can leave a phone trapped in a persistent reboot loop after a specially crafted app is installed. The app does not need to be opened, request permissions, or contain executable code. Researchers reproduced the issue on Android 10 and later, including a Pixel 10 running Android 17.
The problem stems from Android’s handling of ZIP metadata inside APK files. Bitdefender says the system can trust conflicting compression-method and uncompressed-size fields, causing a process that reads the malformed file to access unallocated memory and crash. The researchers demonstrated how the same parsing weakness could affect a core system service rather than only the package installer.
Once the system service enters the crash loop, restarting the phone does not clear it, and the failure continues in safe mode. Bitdefender says recovery may require a factory reset, which erases locally stored data. The researchers also described limited ADB-based recovery conditions when USB debugging was already enabled.
The APK that first triggered the investigation was a banking dropper found in the wild, but Bitdefender said there was no evidence its author knew the malformed file would crash Android. The persistent system-service crash was a separate proof of concept developed by the researchers, and they have not observed that attack being used in the wild.
Bitdefender reported the issue to Google on August 20 and submitted expanded findings on August 25, 2026. According to the researchers, Google considered it outside the scope of a security update and referred it to a feature team for possible consideration in a future Android version.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Android GhostMap Flaw Can Trigger Persistent Boot Loops
