Android GhostMap: installing a crafted app can trap a phone in a crash loop, and Google won't ship a security fix

Bitdefender Labs disclosed GhostMap, an unpatched Android flaw in how the OS reads ZIP entries inside an APK. libziparchive only checks an entry's declared uncompressed size when the entry is marked stored, while libandroidfw maps any entry that is not marked deflated at that declared size. An entry with a third compression-method value passes both, so Android maps far more memory than the file has, and the first read past the real end of the file kills the reading process with a SIGBUS. If the malformed file is a resource that system_server reads, installing the app (no permissions, no code, never opened) leaves the phone in a boot crash loop that continues in safe mode; recovery takes a factory reset, or ADB only if USB debugging was already on. The same trick can crash the installer, the launcher and Settings screens used to uninstall an app, or security scanners. Bitdefender reproduced it on a Pixel 10 running Android 17 with the August 5, 2026 patch and says Android 10 and later are affected. Google closed the first report as Won't Fix (Not Reproducible) and called the second, with a working PoC, outside the scope of a security fix, passing it to a feature team. There is no CVE, and Bitdefender has not seen it used in the wild; the investigation began with a packed banking dropper that only crashed the installer.

Why this severity: Persistent denial of service that can need a factory reset, but the victim has to install a crafted app; no code execution or data access, and no in-the-wild use seen

Started

Nov 5, 2026

• Android
• Google
• #Dos
• #Bitdefender