Osegi
Security·2 min read

GhostMap: Android Flaw Can Trap Phones in an Endless Crash Loop

Bitdefender researchers disclosed GhostMap, an Android bug that sends phones into a reboot loop through a malformed file. Google has so far declined to patch it.

A smartphone showing an error screen stuck in a restart loop, representing the GhostMap Android vulnerability.
Image: 01net.com
SUMODialoediviewergiftdetect

Researchers at Bitdefender have disclosed GhostMap, an Android vulnerability that can throw a phone into an endless crash loop. Installing a single booby-trapped app is enough, and Google has so far declined to ship a security fix.

The app needs no permissions and contains no malicious code, so security tools have little to flag. Everything hinges on a malformed file hidden in the app, one that does not follow the format Android expects. According to Bitdefender, Android misreads two details in it: the compression method and the size the file should have once decompressed. The system then tries to read past the real end of the file and crashes. In the words of team lead Alecsandru Cătălin Daj, the input pushes Android to map the file onto memory that was never allocated.

The process that fails is system_server, a core Android service. It stops and restarts every few seconds, even though no app has been opened. Neither a restart nor Safe Mode helps, Bitdefender says, because the service reads the file before Safe Mode takes effect.

Factory reset is the main way out

The researchers reproduced the bug on a Pixel 10 running Android 17 with the August 5, 2026 security patch. They say every Android version since Android 10 is affected. The only reliable escape is a factory reset, which wipes all data. Users who had enabled ADB (Android Debug Bridge) beforehand may be able to delete the file between two crashes from a connected computer.

Bitdefender warns the flaw could be abused for extortion, by locking a phone and demanding payment. A malicious file could also arrive through an update to an app already installed, or be used to stop a malicious app from being uninstalled or to crash security scanners. No such attacks have been observed so far.

Google's response

Bitdefender reported the issue on August 20 and 25, 2026. Google first closed the report as "Won't Fix (Not Reproducible)", then said the second one fell outside the scope of security fixes and would not be handled by a security update. The case was passed to another Google team that may address it in a future Android release, with no guarantee.

Until then, stick to well-known apps from the Play Store, avoid APK files from the web, and back up your data regularly.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Tags:androidghostmapbitdefendergooglevulnerabilitypixel 10

More from this day

See all →

More in: Security

See all →