Bitdefender finds Android flaw that can trap phones in crash loops

Bitdefender Labs says it found an Android flaw, named GhostMap, that can make a phone repeatedly crash after a specially crafted app is installed. The app does not need to be opened, request permissions or contain executable code. Researchers reproduced the crash loop on a Pixel 10 running Android 17 with the 5 August 2026 security patch, and on Android versions from Android 10 onwards.

The flaw lies in how Android handles ZIP entries inside APK files. Bitdefender says two Android components interpret an entry’s compression method differently: one skips a size check for certain methods, while another maps the file using its declared uncompressed size. When a process reads beyond the actual file into the resulting unmapped space, it crashes with a SIGBUS. If a core system service reads the malformed resource, it can crash and restart repeatedly, preventing the phone from starting properly.

Rebooting and safe mode do not resolve this; recovery may require a factory reset, which erases local data. Bitdefender says ADB may sometimes allow the file to be deleted if USB debugging was enabled beforehand.

The investigation began on 12 August 2026, when a banking dropper APK collected in the wild crashed analysis emulators during installation. Bitdefender says that sample only caused a failed installation; researchers later developed a separate demonstration of the persistent crash loop and have not seen it used against people. Google told Bitdefender the issue was outside the scope of a security update, though it referred the finding for possible consideration in a future version.

Bitdefender says its Mobile Security product detects the malformed apps, but Android does not let third-party apps block installations or remove other apps automatically.