GhostMap Android Vulnerability Can Crash Phones Without Opening an App

Android users could be in for a nasty surprise, as a newly discovered flaw could leave their phones stuck in endless reboot loops.

Dubbed GhostMap, the vulnerability lets a specially crafted Android app put a device into an endless crash loop. The attack requires no special permissions or even opening the app, making it particularly dangerous for unsuspecting users trained to treat an app requesting unusually sensitive permissions as a red alert.

Bitdefender researchers discovered the flaw and say it affects Android 10 and later, with successful tests on a Google Pixel 10 running an August 2026 security update. More concerning, Google has declined to commit to a security update addressing the issue, despite reportedly receiving a working proof of concept.

Unpacking GhostMap

GhostMap isn't after your banking credentials or trying to steal your money. At least, Bitdefender hasn't established any such motive. Instead, it exploits a weakness in Android itself to harm users directly.

Bitdefender's investigation started on Aug 12, 2026, after a suspicious banking dropper repeatedly crashed its Android analysis emulators. 

Interestingly, the application never actually ran. Further investigation revealed that the real problem was how Android handled certain information inside application files.

Android applications typically come in Android Package Kits (APKs), archives containing application code, images, and other resources. The operating system needs to process these contents during installation and when system components access them. GhostMap exploits a weakness in this process.

Specifically, two Android components, libziparchive and libandroidfw, interpret certain APK metadata differently. One field describes how a file is compressed, while another declares its expected size after decompression. An attacker can manipulate this information to make Android process a file using an incorrect size.

When Android attempts to map the malformed file into memory, it can access an invalid memory location, triggering a SIGBUS error that crashes the affected process.

The problem is that Android automatically restarts the crashed process, which is the ideal thing to do, but then, because it encounters the same malformed resource, it crashes again, and again. 

The researchers recorded 110 crash cycles in normal mode and 72 in Safe Mode. Neither mode provided a reliable escape.

Google has not committed to a security fix

Bitdefender didn't just uncover the flaw and walk away. Since it sits within Android itself, the researchers made two attempts to get Google to address it before taking their findings public.

The first report was submitted on Aug. 20, but Google closed it as "Won't Fix (Not Reproducible)." 

Bitdefender returned with additional evidence, including a working proof of concept demonstrating the potential impact. Google then considered the issue outside the scope of a security update and referred it to another team for potential future consideration.

Bitdefender published its findings on Nov. 5, with no security update committed to address the vulnerability. Although researchers found the original banking dropper in the wild, they haven't observed attackers using the persistent crash-loop technique against actual victims. 

However, the danger now lies in the fact that the technical details are public, allowing attackers to study the flaw and race to develop their own exploits before Google delivers a fix.

Here's what you can do to stay safe

With the exploit now public and no security update committed to address it, preventing exposure to a malicious APK should be a priority. 

The usual app installation precautions still apply: 

• Stick to trusted sources, preferably Google Play
• Avoid downloading APKs from unfamiliar websites
• Be wary of applications shared through unsolicited links or messaging platforms
• Verify an App developer using several independent ways before installing an app. This is especially important because an app capable of causing such a crash doesn't even need to run.

The first is a factory reset. Bitdefender found this to be the only reliable recovery option in its tests. It should restore the device to a usable state, but it also wipes all your data. If you have a recent backup, the damage may be manageable. If you don't, you could lose a lot more than access to your phone.

The researchers also identified Android Debug Bridge (ADB) as a possible way to remove the malicious application from a connected computer. That approach requires USB debugging to have been enabled beforehand and may depend on the computer already being authorized to communicate with the device.

For most users, those requirements make ADB an impractical emergency solution.

Until a fix becomes available, avoiding untrusted APKs and maintaining current backups remain important precautions against a vulnerability that could leave users choosing between continued device crashes and a factory reset.

In other news, CrowdStrike research found that attackers began exploiting a vulnerability just 35 minutes after public proof-of-concept code became available, highlighting how quickly cybercriminals can weaponize newly disclosed flaws and the growing pressure on security teams to patch vulnerable systems.