An Android security flaw could turn a seemingly ordinary app installation into a serious recovery problem, with some affected phones potentially requiring a factory reset.
Bitdefender Labs researchers have discovered an Android vulnerability dubbed GhostMap that can leave phones stuck in a continuous crash loop after installing a specially crafted app. The app doesn’t need to be opened, request permissions, or execute code to trigger the problem.
The research, shared with Hackread.com, traces the flaw to differences between Android libraries that parse application package (APK) files. APKs use the ZIP format, but Android’s libziparchive and libandroidfw libraries handle certain compression methods differently.
The problem lies in how the two Android libraries read the same APK file. One checks the file’s actual size, while the other trusts the size written inside it, and this discrepancy allows a malformed APK (file containing inconsistent information about its contents) to pass one library’s checks while causing the other to treat data that doesn’t actually exist as valid.
So, when Android reads this nonexistent data, a SIGBUS error (a signal triggered by an invalid memory access) occurs, eventually causing the affected process to crash.
Crash Loop Can Leave Users Facing Data Loss
Bitdefender first encountered the problem on August 12, 2026, when a banking dropper crashed its analysis emulators during installation. Researchers found that the original sample failed to install, but further testing demonstrated a more serious scenario involving an app that installs successfully.
In that demonstration, Android’s system_server process repeatedly crashes while automatically reading a malformed application resource. Android restarts the service, which encounters the same file and crashes again, leaving the device stuck on its boot screen.
Researchers reproduced the persistent crash loop on a Pixel 10 running Android 17 with the August 5, 2026 security patch. Their tests indicate that Android 10 and later are affected.
Restarting the phone and entering safe mode won’t resolve the issue, researchers noted, and recovery may require a factory reset that will erase locally stored data. USB debugging and Android Debug Bridge (ADB) can offer a limited recovery opportunity only if debugging was enabled beforehand.
Google’s Response
Bitdefender reported GhostMap to Google on August 20, 2026, but Google closed the submission as “Won’t Fix (Not Reproducible).” After Bitdefender submitted a working proof of concept on August 25, Google considered the issue outside the scope of a security update and referred it to the relevant team for possible inclusion in a future Android version.
Researchers note that GhostMap recalls earlier Android parsing problems, including Janus in 2017 and Master Key in 2013. Those flaws exploited disagreements over how Android interpreted APK files, while GhostMap is a different threat that uses similar inconsistencies to crash Android’s own system processes, potentially leaving the device unusable.
Bitdefender has not observed the demonstrated attack scenarios in the wild, but the research shows how a flaw in handling application files could affect the phone before an app even runs.
