Bitdefender says a malformed APK can push an Android phone into a crash loop that only a factory reset reliably ends, and Google has told the researchers it will not fix it in a security update. Bitdefender Labs named the bug GhostMap, and the app that triggers it needs no permissions and never has to be opened.
If you install apps only from Google Play, your exposure is low. For anyone who sideloads, the part worth knowing is how little room you get to recover once it fires.
TL;DR: The GhostMap Android flaw lets a booby-trapped APK crash a core system service on every boot, according to Bitdefender, which says it affects Android 10 and above. Google closed the report as “Won’t Fix” and called it out of scope for a security update. A factory reset is the only dependable recovery, so avoid installing APKs from sources you do not trust.
How the GhostMap Android flaw works
GhostMap comes from two parts of Android reading the same ZIP file differently. Bitdefender says one library checks an entry’s declared size only when the entry is stored, while another checks it only when the entry is deflated, so an entry using any other compression method slips through with an unchecked size.
Android memory-maps the file at that inflated size. When a process reads past the real end, the kernel kills it with a SIGBUS signal.
Aim that at a resource that system_server reads on its own, and the service crashes, restarts, and crashes again. Bitdefender says the first crash came about one second after installing its test app, which had no executable code and asked for no permissions.
The test ran on a Pixel 10 with Android 17 and the August 5, 2026 security patch. That is a recent Pixel on a recent patch, so this is not just an old phone problem.
What Google told Bitdefender about the fix
Bitdefender’s disclosure timeline shows a short exchange that ended without a patch. The company says it first noticed the problem when a banking dropper kept crashing its analysis emulators, then traced the cause to Android itself.
| Date | What happened |
|---|---|
| August 12, 2026 | Bitdefender’s emulators crash on a banking dropper and the bug is found |
| August 20, 2026 | First report sent to Google’s Android and Devices Vulnerability Reward Program |
| August 25, 2026 | Expanded report with a proof of concept sent to Google |
| November 5, 2026 | Bitdefender publishes its analysis, with no Android fix available |
Google first closed the report as “Won’t Fix (Not Reproducible),” per Bitdefender. After the second report, Bitdefender says Google described the issue as outside the scope of a security update and passed it to the relevant team for possible inclusion in a future version. Bitdefender does not quote Google’s exact wording, and Bitdefender’s post lists no CVE.
Bitdefender argues that under Google’s current severity guidelines, a bug that forces a factory reset would rate High. That gap matters more than the “not reproducible” label suggests.
Who is actually at risk from GhostMap
Picture installing an APK a friend sent you, then watching the boot animation repeat while the phone never reaches the lock screen. Bitdefender recorded 110 crash cycles in normal mode and 72 in Safe Mode, so the usual escape hatch does not help.
The bug does not run code, read data, or gain permissions, and Bitdefender says it has not seen it used against anyone. The researchers describe attacks they have not observed, such as an app that breaks its own icon so the launcher crashes when you try to uninstall it.
Google ships fixes through its monthly bulletins when it counts a bug as a security issue. The November Android patch shows what that looks like for a Framework bug that needs no tap, and GhostMap currently has no such fix.
What to do while there is no fix
Stick to Google Play and trusted stores, and treat any APK sent over chat or a download page as suspect. Back up your phone before you try anything unfamiliar, because a factory reset erases local data.
If a phone does get stuck, Bitdefender says a computer can sometimes delete the malformed file between crashes, but only if USB debugging was already on. After the first full kernel reboot that window closes.
Bitdefender also notes that third-party apps cannot block an installation or remove another app, though its own Mobile Security app can warn about malformed files. As a company that sells that product, it has a stake in the story, so weigh the advice with that in mind. For now, how you install apps is your best protection.
