GhostMap Android Flaw Remains Unpatched, May Force Factory Reset
GhostMap, a flaw affecting Android 10 and later, lets a maliciously crafted APK crash a critical system service into a reboot loop that persists after restart and in safe mode; the reported way out is a factory reset, which erases local data. Google, notified by Bitdefender on August 20, 2026, classed the issue as outside the scope of a security fix, and no patch is available. Bitdefender says it has not observed the boot-loop attack in the wild and advises inspecting an APK's structure before running it.
What happened
A flaw in Android, called GhostMap, lets a malicious app render a phone unusable in a continuous reboot loop, requiring no permissions and never needing to be opened. The loop persists after restart and in safe mode; the reported way out is a factory reset, which erases local data. Google was notified on August 20, 2026 and considers the issue outside the scope of a security fix; no patch exists.
Why it matters
An affected device becomes unusable and local data may be lost, with extortion risk according to Bitdefender. Every device on Android 10 or later is affected, including corporate fleets. Bitdefender says it has not seen the attack used in the wild so far.
What to do
Block installation of APKs from outside official stores and tell users to avoid unknown sources. Inspect an APK's structure before running it; Bitdefender detects the issue as Android.Riskware.Ghostmap.rA. Ensure devices are backed up.
For the technical team
- Affected
- Google Android · Android 10 and above, according to Bitdefender. Demonstrated on a Google Pixel 10 running Android 17, with 110 consecutive crashes in testing; reproduced on versions back to Android 10.
- Exploitation
- No boot-loop attack observed in the wild, per Bitdefender. The flaw surfaced when an APK collected from the wild crashed Bitdefender's lab emulators. Cited abuse scenarios: bricking a phone for extortion; making an app impossible to remove (a malformed icon resource crashes the launcher, the Settings app list and the app's info screen); crashing mobile security apps, sandboxes and scanning pipelines that inspect APKs; and delivery through an update to a previously trusted app, which could in theory pass app-store checks.
- Fix
- No fix available. Google classed the issue as outside the scope of a security fix, per Bitdefender. Cited mitigation: inspect the file's structure before running it, since the malformation is visible without installing or running the app; Bitdefender detection: Android.Riskware.Ghostmap.rA.
- Vector
- Component: Android's own resource-parsing code. Flaw: the OS mishandles two fields inside a malformed ZIP entry (compression method and declared uncompressed length), maps the file across memory that was never allocated (hence GhostMap), and any process reading that space takes a SIGBUS and stops. Condition: installing a specially crafted APK is enough; the app requires no permissions, contains no executable code and never needs to be opened. The crash hits system_server and persists after reboot and in safe mode.
- More details
- Discovered and disclosed by Bitdefender, which notified Google on August 20, 2026 (Infosecurity Magazine; the DarkWebInformer post says August 2026). Bitdefender states the problem was not malware but a bug in the Android OS itself. Initial detection came from an APK collected in the wild that crashed the lab's emulators.
Timeline
Bitdefender researchers detail that the malicious app requires no permissions and never needs to be opened: a specially crafted APK makes a critical system service crash into boot loops.
Bitdefender warns the GhostMap flaw remains unfixed and may force users to factory reset their devices to recover.
Flaw disclosed: malicious app can trap Android devices in a persistent boot loop.
Sources 3 sources
- @BleepinComputer @BleepinComputer
- GhostMap Bug Leaves Android Phones Stuck in Reboot Loop Infosecurity Magazine
- @DarkWebInformer @DarkWebInformer
