Security researchers at Bitdefender Labs have discovered an Android vulnerability dubbed GhostMap that could allow a specially crafted application to render a smartphone unusable simply by being installed. The application requires no permissions, contains no executable code, and does not need to be opened to trigger the flaw.
The vulnerability affects how Android processes malformed ZIP entries within APK files. By exploiting inconsistencies in how Android libraries interpret compression methods and file sizes, a malicious application can cause a core system process to crash repeatedly, resulting in a persistent boot loop.
According to Bitdefender, restarting the device or entering safe mode does not resolve the issue. Recovery may require a factory reset, potentially erasing locally stored data. In limited circumstances, Android Debug Bridge (ADB) may allow the affected file to be removed if USB debugging was previously enabled.
The vulnerability stems from inconsistent validation between two Android libraries, libziparchive and libandroidfw, which handle APK file structures differently.
If the malformed resource is accessed by system_server, a critical Android process, the operating system repeatedly restarts the service and encounters the same fault, preventing the device from completing startup.
Bitdefender reproduced the persistent crash loop on a Pixel 10 running Android 17 with the August 5, 2026 security patch.
Although GhostMap does not enable arbitrary code execution, data theft, or privilege escalation, researchers identified several potential denial-of-service scenarios.
Attackers could theoretically exploit the vulnerability to disable Android devices, interfere with application removal, or crash security tools that inspect malformed APK files. The resulting disruption and potential data loss could also be used as leverage in extortion attempts.
The investigation began on August 12, 2026, when an APK containing a banking malware dropper caused Bitdefender’s analysis emulators to crash during installation. Further research revealed that the underlying flaw could be exploited to produce persistent system crashes.
However, Bitdefender emphasized that it has not observed GhostMap being deliberately exploited in real-world attacks.
Previous Android APK Vulnerabilities
GhostMap is part of a broader category of parser differential vulnerabilities, where different components interpret the same file structure inconsistently.
A 2014 research paper, Leaving our ZIP undone: How to abuse zip to deliver malware apps, examined how malformed ZIP structures could bypass conventional antivirus analysis.
Earlier Android vulnerabilities demonstrated similar weaknesses. The Master Key vulnerability (CVE-2013-4787) exploited inconsistencies between APK signature verification and installation, while Janus (CVE-2017-13156) allowed attackers to exploit differences between signature verification and executable loading.
More recently, BadPack techniques have involved manipulating APK ZIP headers to evade security analysis. <a href="https://unit42.paloaltonetworks.com/apk-badpack-malware-tampered-headers/” rel=”nofollow noopener” target=”_blank”>Palo Alto Networks Unit 42 identified approximately 9,200 such samples over a one-year period, including malware associated with banking trojans such as Anatsa, Cerberus, and BianLian.
Unlike these techniques, which primarily focus on bypassing security checks or concealing malicious code, GhostMap exploits parsing inconsistencies to crash the processes handling malformed APK resources.
Google’s Response and Mitigation
Bitdefender reported its findings to Google on August 20 and August 25, 2026, through the Android & Devices Vulnerability Reward Program.
Google initially closed the report as Won’t Fix (Not Reproducible). Following the second submission, which included a working proof of concept demonstrating persistent denial of service, Google indicated that the issue was outside the scope of a security update and had been forwarded for possible consideration in a future Android release.
At the time of Bitdefender’s publication, no security fix was available.
According to the researchers, the malformed APK structure can be detected before installation. Bitdefender Mobile Security can identify affected applications and warn users, although Android’s security restrictions prevent third-party applications from independently blocking installations or removing other apps.
The discovery highlights the security risks associated with inconsistent APK parsing and reinforces the importance of detecting malicious application packages before they are installed.
