Bitdefender has disclosed GhostMap, a flaw that can leave an Android device stuck in a persistent crash loop after a specially crafted app is installed. The app requires no permissions, contains no executable code and does not need to be opened, according to Bitdefender’s technical report.
The flaw involves inconsistent handling of compression methods and declared size information in APK ZIP entries. Bitdefender says a malformed entry can be mapped beyond the file’s actual contents; when a core Android process reads the resulting region, it crashes and restarts. The researchers created an app that caused the system_server process to repeat that cycle, blocking normal access to the device and continuing in safe mode. BleepingComputer reports that the test was conducted on a Pixel 10 running Android 17 with the August 5 security patch; the crash cycle began about one second after installation and repeated 110 times in normal boot mode and 72 times in safe mode.
The evidence supports a demonstrated denial-of-service impact, not confirmed exploitation against deployed victims. Bitdefender said its investigation began with a banking dropper collected from the wild, but that sample caused an installation failure rather than the persistent crash loop; the researchers said they have not observed the more damaging technique used against anyone. No CVE or broader affected-version list is provided in the fetched reports.
For defenders, the practical distinction is that installation is the trigger and recovery may be disruptive: Bitdefender says a factory reset may be required, erasing local data, while ADB-based deletion is available only if USB debugging was already enabled and a script can act before the repeated crashes. Google closed the initial report as “Won’t Fix (Not Reproducible)” and later treated the expanded issue as outside the scope of a security-update fix, while forwarding it for possible consideration in a future version update, according to Bitdefender and BleepingComputer. No official Google patch or mitigation is identified in either report.