Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Bitdefender Discovers GhostMap ZIP Flaw Causing Persistent Android Crash Loops

6 sources · 6 articlesFirst reported Updated ()1
What's new

November 6: GBHackers reports on GhostMap crash loop vulnerability in Android devices.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Bitdefender Labs' GhostMap vulnerability causes Android 10+ phones to crash in persistent reboot loops via no-permission malicious APKs; Google refuses a patch.

Bitdefender Labs discovered GhostMap, a flaw in Android's ZIP parsing that mishandles compression methods and uncompressed lengths in APKs. This triggers SIGBUS crashes in system_server, creating a crash loop that persists after reboot and in safe mode. The issue affects Android 10 through 17 and was reproduced on a Pixel 10 with the August 5, 2026 patch. Recovery requires a factory reset, as the bug needs no permissions, no executable code, and no interaction to trigger. Google classified it as out of scope for security updates after reports in August 2026; no exploitation in the wild has been observed.

Key facts
  • Affects Android 10 to 17
  • No permissions or code execution needed
  • Crash loop persists in safe mode
  • Requires factory reset to recover
  • No CVE assigned
  • Reproduced on Pixel 10 with Aug 5 2026 patch
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Aug 12, 2026Bitdefender Labs analysis began after banking dropper crashed emulators · Cyber Security News
  2. Aug 20, 2026Bitdefender reported GhostMap flaw to Google · BleepingComputer
  3. Aug 25, 2026Bitdefender reported GhostMap flaw to Google again · BleepingComputer
  4. Aug 5, 2026August 5 security patch applied to Pixel 10 · BleepingComputer
  5. Nov 5, 2026Bitdefender Labs publicly disclosed GhostMap · Help Net Security
  6. Nov 6, 2026GBHackers published report on GhostMap · GBHackers

What each outlet adds

beyond the shared facts
  • Help Net SecurityFound while analyzing banking malware dropper sample
  • BleepingComputerCrash loop ran 110 times in normal boot and 72 times in safe mode
  • Cyber Security NewsAnalysis started August 12 2026; 8408-byte APK mapped across 16 MB
  • Infosecurity MagazinePotential for device bricking or disabling security tools
  • GBHackersNew coverage dated November 6 on permanent phone crashes
Vendors
GoogleBitdefender
Products
Android
Organizations
BitdefenderBitdefender Labs

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Help Net SecurityFirst report

    Android ZIP parser bug crashes phones in loop

    Bitdefender Labs discovered GhostMap, a vulnerability in Android's ZIP handling that crashes devices in a loop without permissions or interaction; Google has no plans to patch it.

  2. · 4d ago Bitdefender Labs

    Android flaw causes persistent crash loop on APK install

    Bitdefender identified an Android vulnerability where a specially crafted APK triggers a SIGBUS crash leading to a boot loop requiring factory reset.

  3. · 4d ago BleepingComputer

    GhostMap Android flaw lets installed app force a boot loop

    Bitdefender’s no-permission demo crashed a Pixel 10 on Android 17; Google closed the report without a patch.

  4. · 4d ago Infosecurity Magazine

    GhostMap Bug Leaves Android Phones Stuck in Reboot Loop

    Bitdefender discovered a ZIP entry bug in Android 10+ that causes SIGBUS crashes in a persistent reboot loop fixable only by factory reset.

  5. · 4d ago Cyber Security News

    GhostMap Android flaw can trap phones in reboot loops after install

    Bitdefender says the bug starts at Android 10, has no CVE or fix, and Google declined a security update.

  6. · 3d ago GBHackers

    GhostMap Android Vulnerability Can Crash Phones

    GhostMap flaw crashes Android phones in a loop after installing a crafted APK without permissions.