Bitdefender Labs says it found a flaw in Android, which it calls GhostMap, that lets a specially crafted app put a phone into a boot loop. The app contains no executable code, asks for no permissions and does not even need to be opened: installing it is enough. A core system process then crashes, restarts, reads the same file and crashes again. Bitdefender says restarting does not help and neither does safe mode.
Bitdefender traces it to Android mishandling two fields in the ZIP entries of an app’s package file: the compression method and the declared uncompressed length. A malformed entry makes Android map the file across memory that was never allocated, and any process that reads it crashes. Bitdefender found the problem on August 12 after a banking-trojan sample it collected crashed its analysis emulators, and says nothing suggests the malware author knew the file would do that. It then built its own proof of concept and reproduced the loop on a Pixel 10 running Android 17 with the August 5, 2026 security patch. The company says it also reproduced the crash on versions starting with Android 10. It has not seen the technique used in attacks, and the bug crashes processes rather than running code or reading data.
Bitdefender reported the issue to Google on August 20 and, with expanded findings, on August 25. Google first closed it as “Won’t Fix (Not Reproducible)”, then said it was outside the scope of a security update and referred it to a feature team for possible inclusion in a future version. BleepingComputer says it asked Google about the fix status and had not heard back at publication.
How to check if you’re affected
Affected devices are Android phones and tablets running Android 10 or newer; Bitdefender’s main test device was a Pixel 10 on Android 17 with the August 5, 2026 patch. Bitdefender says no fix is available, Google has said it will not address this through a security update, and the sources list no CVE.
Bitdefender says there are limited options on the device itself. The only recovery methods it found are a factory reset, which erases locally stored data, or, in limited conditions, deleting the malformed file with ADB (Android Debug Bridge) from a computer, which only works if USB debugging was already on and the script runs before the system crashes. Because recovery may cost you locally stored data, anything that exists only on the phone is at risk if this is ever abused.
Bitdefender says the practical defense is to recognize the crafted file before it is read. Its own Bitdefender Mobile Security product detects it as Android.Riskware.Ghostmap.rA and warns the user, but Android does not let a third-party app block an installation or remove another app on its own, so the user must act on the warning. Bitdefender sells that product and says other security tools may offer similar protection.