Security researchers have disclosed an Android flaw, dubbed GhostMap, that can trap a phone in an endless crash loop after a user installs a single crafted app — even if the app is never opened and asks for no permissions. Bitdefender Labs published its findings on Wednesday 5 November. It affects Android 10 and later.

How a harmless-looking app crashes the phone

The problem lies in how Android handles app installation files. An APK file is essentially a ZIP archive, and Android mishandles two fields inside a ZIP entry: the compression method and the declared uncompressed length. When a process reads such an entry, the CPU raises a SIGBUS fault and the process is killed.

In the worst case, the crafted app targets system_server, the core process behind most Android functions. After installation, a system service reads a small resource inside the app and crashes, restarts, and reads the same file again. The phone never finishes starting. In Bitdefender's tests the first crash came about one second after installation, repeating 110 times in normal mode and 72 times in safe mode. Neither restarting nor safe mode helps.

No fix, and a factory reset is the only way back

For most users, the only recovery is a factory reset, which erases locally stored data. Bitdefender reported the issue to Google on 20 August, and Google closed it as "Won't Fix (Not Reproducible)". Google said a fix might be considered for a future version. No CVE identifier has been assigned.

Bitdefender says it has not seen attackers use the crash loop against real users, and GhostMap does not steal data, run code or raise permissions — it only crashes the device.

Sources: Bitdefender Labs, GhostMap Android, 5 November 2026; BleepingComputer, GhostMap Android flaw lets malicious app trigger persistent boot loop, 5 November 2026; Cybernews, New Android vulnerability GhostMap crash loop, 5 November 2026.