Science & Tech · Cybersecurity · 4 hrs ago
GhostMap flaw can trap Android phones in a crash loop
Bitdefender found a flaw in Android called GhostMap while investigating an app that crashed its test devices.
The flaw involves how Android reads certain files inside an app package, and the reports say it affects Android 10 and later.
A specially crafted app can trigger repeated crashes after installation, even if it asks for no permissions and is never opened.
The crash can affect a core Android service, leaving the phone stuck in a loop that may continue in safe mode.
A factory reset can stop the loop but erases locally stored data; deleting the file with ADB may also work if debugging was already enabled and there is time to act.
Bitdefender warned that attackers could use the flaw to disable phones or threaten to do so for extortion.
Google has not released a fix, saying the issue is outside the scope of a security update, though it may consider it for a future update.
Bitdefender disclosed GhostMap, an Android vulnerability that can make a phone repeatedly crash after a specially crafted app is installed.
The flaw involves malformed data in an APK that can cause Android to read from unallocated memory.
The crash loop can persist through reboot and safe mode, and a factory reset can erase locally stored data.
Bitdefender says the flaw affects Android 10 and later and that Google has not released a fix.
Google classified the issue as not reproducible and outside the scope of a security update, while reserving it for possible consideration in a future update.
- Who
- Bitdefender discovered and reported the flaw; Android users may be affected.
- What
- GhostMap can trigger repeated crashes and a persistent boot loop when a crafted app is installed.
- When
- Bitdefender reported the issue to Google on August 20; the articles were published on November 5, 2026.
- Where
- Android devices.
- Why
- Malformed APK data can make Android map a file beyond its contents, causing a process to crash when it reads from unallocated memory.
Bitdefender
Fix status
Bitdefender
Bitdefender says GhostMap is an Android flaw that can make devices unusable and should be addressed.
Google classified the report as not reproducible and outside the scope of a security update, while reserving it for possible consideration in a future update.
Risk and response
Bitdefender
Bitdefender warns attackers could use a crafted app to trigger crashes and says detection before installation is the practical defense.
Google’s stated position in the articles is that the issue is not reproducible and is out of scope for a security update.
Bitdefender reported GhostMap to Google.
Bitdefender submitted an extended version of its report, believing Google had misclassified the original.
Infosecurity Magazine and BleepingComputer published reports about GhostMap.
- Affected versions
- Android 10 and above
- Reported to Google
- August 20
- Extended report submitted
- August 25
- Demonstration device
- Pixel 10 running Android 17 with the August 5 security patch
- Crash-loop duration in tests
- 110 repetitions in normal boot mode and 72 in safe mode
3 sources
What people are saying
Reading such an entry causes a SIGBUS (a signal sent by the CPU to stop a process that accesses an invalid memory space) in whichever process touches the file
The most practical defense is to recognize the file before the bug is triggered