On 5 November 2026 Bitdefender Labs disclosed GhostMap, a flaw that it says affects every Android version from Android 10 up. Simply installing a specially built app is enough: it does not need to be opened, asks for no permissions and contains no code. If a core system service reads the crafted file, that service crashes again on every restart and the phone never finishes booting.
How it works: an APK is a ZIP file. Two Android system libraries, libziparchive and libandroidfw, treat unusual compression values differently. With a fake compression method and a large declared size, Android maps far more memory than the file holds — in Bitdefender's test an 8,408-byte file was mapped across about 16 MB — and reading past the real end of the file triggers a SIGBUS crash. On a Pixel 10 running Android 17 with the 5 August 2026 patch, the first crash came about one second after installation; one capture showed the cycle repeating 110 times, and 72 times in safe mode.
Recovery is painful. Rebooting and safe mode do not help. A factory reset, which erases local data, is typically required. Deleting the file over ADB only works if USB debugging was already switched on, and only until the first full reboot. Bitdefender warns a rogue app could use this to lock a phone and demand money.
Google's answer: Bitdefender reported the issue on 20 and 25 August 2026. Google first closed it as "Won't Fix (Not Reproducible)"; after the second report it said the issue "will not be addressed through a security update" and passed it to a feature team. No fix exists and there is no CVE. Bitdefender found the bug through a banking-malware sample whose packer accidentally broke installs, but says it has not seen the crash loop used against anyone.
