A newly identified Android exploit may cause your phone to enter a crash loop without you even opening any malicious apps. The process is called GhostMap, and it was identified by researchers at antivirus company Bitdefender when working on a separate flaw.
The researchers found that an app’s files could cause your phone to crash, restart, and then crash again as your device retries the same, broken process. The flaw is part of Android, although the app’s files instigate the problems.
If you use an Android phone in the UAE, Saudi Arabia, or Egypt, your risk depends on the files you install, not on where you bought the handset. The research doesn’t name specific phone models, so treat this as relevant to Android devices used across the Middle East.
GhostMap is caused by the Android operating system mishandling the compression method and the declared uncompressed length fields within a ZIP entry. The broken entry then sends a SIGBUS signal, which the CPU is designed to raise when it attempts to access invalid memory, causing the crash loop to begin.
It persists even in safe mode, meaning the problem continues until you perform a full factory reset, which will result in the loss of your data.
Bitdefender found that the only way to avoid the GhostMap exploit without losing data was to have USB debugging enabled on the device beforehand. If it’s active, you can connect it to a computer and use Android Debug Bridge to delete any offending files.
Most security exploits require you to download and enable software before any issues begin, but GhostMap means that just downloading it is enough to trigger them. The good news is that this exploit has yet to be spotted in any publicly available apps, with Bitdefender identifying the issue in advance.
Bitdefender told Google about the problems, and Google said that the issues are “outside the scope of a security update fix.” Google says a relevant team is aware of the problem, and it may be fixed in a future version update. If true, it may mean a long wait, as Android 18 is unlikely to land until some point in 2027.
Bitdefender’s decision to make this problem public may encourage Google to plug the gap quickly and prevent bad actors from exploiting it. The problem is that this disclosure may also encourage more threat actors to try it out, making it a more common threat.
What GhostMap means for Android users in the Middle East
Because Google hasn’t tied the fix to a security update, phones bought through carriers such as du, e&, or STC may take longer to receive a patch. Check Settings for system updates regularly, and don’t assume a carrier-branded handset will get the fix on the same schedule as a Pixel.
Bitdefender’s recovery method depends on USB debugging being turned on before the problem appears. If you want that option, it’s worth learning how to enable it under Developer options now, rather than searching for it after your phone is stuck in a loop. Apps sideloaded from outside Google Play, including APK files shared in messaging groups, deserve extra caution in the region.
Be sure to only download applications and software you trust to your Android device. If you’re ever unsure about the authenticity of an application, look for other sources, such as the developer’s website and any relevant reviews, and identify the most negative among them to look for any risks.
