Aug 12, 2026
0 new incidents, 1 with updates.
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Updated
- LiveMediumNo patch yet
Android GhostMap: installing a crafted app can trap a phone in a crash loop, and Google won't ship a security fix
Bitdefender Labs disclosed GhostMap, an unpatched Android flaw in how the OS reads ZIP entries inside an APK. libziparchive only checks an entry's declared uncompressed size when the entry is marked stored, while libandroidfw maps any entry that is not marked deflated at that declared size. An entry with a third compression-method value passes both, so Android maps far more memory than the file has, and the first read past the real end of the file kills the reading process with a SIGBUS. If the malformed file is a resource that system_server reads, installing the app (no permissions, no code, never opened) leaves the phone in a boot crash loop that continues in safe mode; recovery takes a factory reset, or ADB only if USB debugging was already on. The same trick can crash the installer, the launcher and Settings screens used to uninstall an app, or security scanners. Bitdefender reproduced it on a Pixel 10 running Android 17 with the August 5, 2026 patch and says Android 10 and later are affected. Google closed the first report as Won't Fix (Not Reproducible) and called the second, with a working PoC, outside the scope of a security fix, passing it to a feature team. There is no CVE, and Bitdefender has not seen it used in the wild; the investigation began with a packed banking dropper that only crashed the installer.
Android (AOSP libziparchive / libandroidfw APK parsing)Since Nov 5, 2026
