On August 12, 2026, a banking dropper collected in the wild crashed Bitdefender’s analysis emulators the moment researchers tried to install it. The crash led the security firm’s mobile team to a deeper problem in how Android reads app files — one it has dubbed GhostMap, a flaw that can leave a phone stuck in an endless crash loop after a specially crafted app is installed, even though the app needs no permissions, contains no executable code and never has to be opened, itbrief.com.au reported.
Bitdefender said the issue affects devices running Android 10 and later. During its tests, the crash survived a reboot and persisted in safe mode, meaning a factory reset remained the primary recovery path for most users.
Bitdefender researchers detail GhostMap, an Android ZIP-parsing flaw that can make a crafted app trigger a persistent system crash loop, potentially requiring a data-erasing reset. Reproduced on Android 10+; no in-the-wild use observed, and Google says no security fix.…
What GhostMap Does to an Android Phone
The demonstrated app crashes the device roughly one second after installation, according to cyberinsider.com. If a core system service reads the malformed file after installation, the crash lands inside system_server — the central Android process that hosts many system services — and when that process restarts, it encounters the same installed app and crashes again. The result can be a continuous reboot cycle in which the screen stays on the boot animation, cybernews.com reported.
Bitdefender reproduced the issue on a Pixel 10 running Android 17 with the August 5, 2026 security patch, and found the same behavior on versions dating back to Android 10, itbrief.com.au reported. Safe mode did not interrupt the cycle because the affected service read the malformed file before safe mode took effect.
The vulnerability cannot be used for code execution, data theft or privilege escalation — it is confined to denial of service — yet the consequences can still be serious, because the crash loop may render the phone unusable and compel the owner to wipe locally stored data.
How a Few Kilobytes Can Map to 16 Megabytes of Memory
APKs — Android application packages — are essentially ZIP archives, and according to Bitdefender, Android mishandles two specific fields within a ZIP entry: the compression method and the declared uncompressed length. When those fields are malformed in a particular way, a process reading the file triggers a SIGBUS fault — a signal the CPU sends to stop a process that accesses an invalid memory space — and crashes, cybernews.com reported.
🚨 New Android vulnerability can trap phones in endless boot loops without app permissions Security researchers at Bitdefender have discovered a serious Android vulnerability, dubbed GhostMap, that allows a malicious app to render a smartphone unusable simply by being installed.… pic.twitter.com/7YA3bu0L8h
The trouble comes from two Android libraries interpreting the same ZIP entry differently. An entry specifying an unsupported compression method can therefore bypass the size check while still being mapped with an inflated length. Bitdefender’s researchers created an APK only a few kilobytes in size that mapped to 16MB of memory; when Android tried to read past the end of the actual file, the kernel killed the process.
Which part of the operating system crashes depends on which file in the APK is malformed and which Android component reads it. A damaged manifest crashes the installer and the app fails to install, with no lasting effect. A resource read automatically after installation can bring down system_server — and that is what produces the persistent loop.
New Android threat uncovered: “GhostMap” lets a benign-seeming APK crash phones into endless reboot loops—no access needed, no code run. Affects Android 10+ and works even when safe mode is enabled. #Android #Vulnerability #GhostMap #MobileSecurity #Bitdefender#Android… pic.twitter.com/5kryFU8Cit
Why Google Has Declined a Security Fix
Bitdefender said it reported the issue twice through Google’s Android & Devices Vulnerability Reward Program. The first report, filed on August 20, 2026, was closed as not reproducible and outside the program’s scope. A follow-up submission on August 25 provided a proof of concept along with reproduction instructions for a persistent system crash loop; Bitdefender stated that Google replied the issue fell outside the scope of a security update fix and had been passed to a relevant team for possible inclusion in a future version update, itbrief.com.au reported.
Bitdefender contended that the bug poses a serious denial-of-service threat since it can render a device unusable without requiring code execution or elevated permissions, and noted that it had not seen the persistent crash-loop method deployed against victims in the wild.
‼️ GhostMap Android Flaw Can Trap Phones in Endless Reboot Loops Without Opening an App Details: https://t.co/HW2p99y2gh A new Android bug named GhostMap can leave a phone stuck in a crash loop after a user installs a single crafted app. The app does not need to be opened,… pic.twitter.com/ynheNz4Sr0
From a Banking Dropper to a System-Wide Parser Problem
Researchers first identified the issue after the banking dropper — wrapped in a packer that altered the APK’s internal structure — crashed emulators during installation. That probe brought them to what they called a more fundamental issue in how Android processes ZIP entry data within APK files. Bitdefender connected the behavior to an enduring category of parser differential issues in Android, in which various components of the operating system read the same APK structure differently.
Any app or service using Android’s native APIs to parse a malformed APK could crash, including security scanners that rely on standard package inspection calls.
What Users Can Do Right Now
With no fix available, prevention depends largely on identifying a crafted file before Android reads it. Bitdefender’s mobile security tool flags the malformed files as Android.Riskware.Ghostmap.rA and can alert users when such an app arrives on the device, though Android prevents a third-party app from blocking an installation or directly uninstalling another app, so the decision rests with the user. In a small number of situations where USB debugging was already turned on, a user might attempt to delete the file via Android Debug Bridge before the system crashed once more, although even that possibility could vanish following a complete reboot.
Questions Readers Ask About GhostMap
If my phone is stuck in the loop, can I remove the app without losing data?
Only in limited cases. Otherwise, a factory reset works and erases all locally stored data.
GhostMap: the Android flaw that can lock your phone without you even opening the app.https://t.co/SMghvG4L2m#GhostMap #Android #AndroidSecurity #Bitdefender #CyberSecurity #Malware #SmartphoneSecurity #GooglePlay #TechNews #GadgetFlux pic.twitter.com/E1Q1JLxaEW
“The app contains no code and never needs to run,” said Alecsandru Cătălin Daj, Team Lead in the Mobile Security & Forensics Unit at Bitdefender.