A newly disclosed Android bug called GhostMap can push a phone into a crash loop that survives restarts, and Google has not released a fix. Researchers at Bitdefender say a specially built app only has to be installed, never opened, and needs no permissions at all.[1][2] Nobody has been seen using it against real victims yet, but the way out is harsh: a factory reset that wipes whatever is stored on the phone.[1]
What happened with GhostMap
Bitdefender’s mobile team stumbled on the problem while studying a banking trojan sample. On August 12 the sample kept crashing the company’s test emulators during installation, and the team traced the cause to Android itself rather than to the malware.[1][3] They reported it to Google on August 20 and got back a short reply: “Won’t Fix (Not Reproducible)”.[2]
Bitdefender sent a second report on August 25 with a working demonstration of a crash loop that does not end. According to the researchers, Google again judged it outside the scope of a security update but said it would pass the finding to a feature team that might look at it in a later Android version.[1] Bitdefender published its write-up on November 5, 2026.[1]
How the bug works
An Android app package is really a ZIP file, and two separate parts of Android read that file in slightly different ways. One checks the declared size of an entry only for entries stored without compression. The other maps any entry that is not marked as compressed at its declared size, without checking it against the real file.[1]
An entry with an unusual compression label slips between the two checks. Android then reserves far more memory than the file actually holds, and the moment any process reads past the true end, it crashes with an error called SIGBUS.[1][3] Bitdefender wrote that “reading such an entry causes a SIGBUS” in whichever process touches the file.[2]
In the demonstration, the researchers built an app with a resource that the core service system_server reads right after installation. Each crash restarts the service, which reads the file again and crashes again.[2] BleepingComputer reports the loop repeated 110 times in normal mode and 72 times in Safe Mode.[2]
Which phones are affected
Here the sources differ in how far they go. Bitdefender and Infosecurity Magazine say the flaw affects Android 10 and later.[1][3] BleepingComputer only describes the test device, a Pixel 10 running Android 17 with the August 5, 2026 security patch, and does not list other models.[2] Treat any Android phone from the last several years as potentially exposed until Google says otherwise.
What the attack could do, and what it cannot
GhostMap does not run code, read your files or grant an attacker any access. It is a way to break a phone, not to spy on one.[1] Bitdefender stresses that it has not seen any of the scenarios it describes happening in the wild, and that the original sample it found only caused a failed install.[1]
The researchers still list several ways criminals could abuse it. A crook could brick a phone and demand money to explain the fix. A malicious app could become impossible to remove if the launcher and the Settings app list crash whenever they try to display its icon, though Bitdefender calls that its own hypothesis.[1][3] It could also arrive later through a harmless-looking app update that gets past store checks.[3]
What Google and Bitdefender say
Google has not shipped a patch. BleepingComputer asked the company about the status of a fix and had received no answer at the time of publication.[2] Bitdefender argues the bug deserves a High rating, comparing it with a 2016 reboot-loop flaw that Google rated Moderate.[1]
Bitdefender notes that Android does not let security apps block an install, so a scanner can warn you but cannot stop the package. The company says “this is a flaw in Android itself”.[3]
What to do now
Since the trigger is an installed app, be picky about what goes on your phone. Our guide on removing Android viruses explains how to check a phone that is already acting strangely, and the page on a trojan downloader shows how droppers like the one Bitdefender found work.
- Update Android and Google Play system updates when they appear, even though no GhostMap fix exists yet.
- Do not sideload APK files from links, messaging groups or unknown websites.
- Back up photos, contacts and messages now, because a factory reset deletes local data.
- Treat any demand for money to fix a looping phone as a scam, and see stalkerware on Android for other signs of tampering.
What comes next
The open question is whether Google changes its mind. Bitdefender’s public write-up also means copycats now know where to look.[1] Until a fix arrives, the risk for most people is low but not zero, and it rests on which apps you let onto your phone. See also Android Charging Boost.
Frequently asked questions
What is GhostMap?
GhostMap is the name Bitdefender gave to an Android bug where a malformed app package makes the system map far more memory than the file holds, which crashes any process that reads it.
Do I have to open the malicious app for it to work?
No. The researchers say the app only has to be installed, and it needs no permissions and holds no executable code.
Has GhostMap been used in real attacks?
Bitdefender says it has not seen the scenarios it describes in the wild. The sample it found only caused a failed install.
Which Android versions are affected?
Bitdefender and Infosecurity Magazine say Android 10 and later. BleepingComputer only mentions a Pixel 10 on Android 17 with the August 5 patch.
Is there a patch from Google?
Not at the time of writing. Google called the report out of scope for a security update and said it may consider the matter for a future version.
How do I recover a phone stuck in the loop?
Restarting and Safe Mode do not help. A factory reset works but erases local data.
