Bitdefender Labs has disclosed GhostMap, an Android flaw that lets an app with no permissions and no executable code trap a phone in an endless boot loop that survives reboots and safe mode. The bug affects Android 10 and later, and Google has not issued a fix after reportedly closing the report.
How a Malformed APK Crashes system_server
Bitdefender found the problem after a sample from the wild, described by BleepingComputer as an Android banking trojan, kept crashing the firm’s emulators. The researchers concluded that the root cause is a bug in the Android operating system and not in the malware.
Android handles two fields in ZIP entries inconsistently across two libraries: the compression method and the declared uncompressed length. A malformed APK can therefore slip past size checks, and Android maps the file across unallocated memory. Reading it triggers a SIGBUS error in whichever process touches it.
Proof of Concept on a Pixel 10
Bitdefender built a proof-of-concept app with no executable code and no permissions, and the app does not need to be launched. In tests on a Pixel 10 running Android 17 with the Aug. 5 security patch, installing the app caused system_server to crash repeatedly, and the loop began about a second after installation.
The loop persists through reboots and safe mode. Only a factory reset, which wipes local data, recovers the device.
Google’s Response to Bitdefender’s GhostMap Report
Bitdefender notified Google on Aug. 20. BleepingComputer reported that Google closed the report as “not reproducible,” while Infosecurity Magazine described the response as treating the issue as outside the scope of a security fix. In either account, no patch has been issued.
GhostMap Disclosure Date and Affected Android Versions
Bitdefender made the findings public on Nov. 5, roughly 11 weeks after the initial report. The flaw affects Android 10 and later versions, which covers a large portion of active Android devices.
GhostMap Abuse Scenarios: Bricked Phones and Extortion
The reports identify two main ways the flaw could be used. An attacker could brick a victim’s phone by getting a fake application installed. The bug could also support extortion, since recovery requires a factory reset that erases local data.
Why the Impact Is Denial of Service, Not Data Theft
GhostMap does not give an attacker access to data or code execution. Its effect is a persistent denial of service on the device. The risk to data comes indirectly: if a factory reset is the only way back, a user without a recent backup loses whatever was stored only on the phone.
The sources recommend avoiding sideloaded or suspicious apps as the main protection, since no vendor patch exists. They do not report any confirmed attacks that used the flaw against real victims, apart from the sample that led Bitdefender to the discovery.
What the Discovery Shows About the Original Sample
The malware sample that exposed the bug kept crashing Bitdefender’s emulators. Bitdefender’s analysis separated the malware from the underlying operating-system behavior, and the proof of concept demonstrates that the crash does not depend on any malicious code in the app.
With Google declining to treat the issue as a security fix, the public disclosure leaves Android 10 and later devices exposed to the technique described by Bitdefender. The research provides the technical mechanism, the test conditions and the recovery limitation, and the remaining open question is whether Google will revisit its decision in light of the public details.
Timeline From Emulator Crashes to Public Disclosure
Bitdefender’s investigation started with a banking trojan sample that kept crashing its emulators. The researchers traced the crashes to the operating system, built a proof of concept, and reported the bug to Google on Aug. 20. The proof-of-concept tests used a Pixel 10 running Android 17 with the Aug. 5 patch, which shows the flaw was present in a recent, fully patched build at the time of testing.
Infosecurity Magazine and Cybernews also covered the disclosure on Nov. 5. The coverage names the technical trigger, inconsistent handling of the compression method and declared uncompressed length fields in ZIP entries, but no CVE identifier has been reported for GhostMap.
