# Android GhostMap: installing a crafted app can trap a phone in a crash loop, and Google won't ship a security fix · pwn.watch > Bitdefender Labs disclosed GhostMap, an unpatched Android flaw in how the OS reads ZIP entries inside an APK. libziparchive only checks an entry's declared uncompressed size when the entry is marked stored, while libandroidfw maps any entry that is not marked deflated at that declared size. An entry with a third compression-method value passes both, so Android maps far more memory than the file has, and the first read past the real end of the file kills the reading process with a SIGBUS. If the malformed file is a resource that system_server reads, installing the app (no permissions, no code, never opened) leaves the phone in a boot crash loop that continues in safe mode; recovery takes a factory reset, or ADB only if USB debugging was already on. The same trick can crash the installer, the launcher and Settings screens used to uninstall an app, or security scanners. Bitdefender reproduced it on a Pixel 10 running Android 17 with the August 5, 2026 patch and says Android 10 and later are affected. Google closed the first report as Won't Fix (Not Reproducible) and called the second, with a working PoC, outside the scope of a security fix, passing it to a feature team. There is no CVE, and Bitdefender has not seen it used in the wild; the investigation began with a packed banking dropper that only crashed the installer. Page: https://pwn.watch/i/android-ghostmap-apk-zip-crash-loop-unpatched · generated 2026-11-05T14:39:04.572Z ## Status - Severity: medium · status: live · patch: unpatched - Product: Android (AOSP libziparchive / libandroidfw APK parsing) - Started: 2026-11-05 - Affected: Android 10 and later (reproduced on a Pixel 10 with Android 17, August 5, 2026 security patch) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/android-ghostmap-apk-zip-crash-loop-unpatched/feed.xml - JSON Feed: https://pwn.watch/i/android-ghostmap-apk-zip-crash-loop-unpatched/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/android-ghostmap-apk-zip-crash-loop-unpatched.json - This file: https://pwn.watch/i/android-ghostmap-apk-zip-crash-loop-unpatched/llms.txt ## Updates (newest first) - 2026-11-05: Bitdefender publishes the GhostMap research; no fix or CVE exists and no in-the-wild use has been seen. (https://www.bitdefender.com/en-us/blog/labs/ghostmap-android) - 2026-08-25: A second report with a working PoC of the persistent system_server crash loop is called outside the scope of a security fix and passed to a feature team for a possible future version. (https://www.bitdefender.com/en-us/blog/labs/ghostmap-android) - 2026-08-20: Bitdefender reports the installer and parser crashes to Google's Android and Devices VRP; Google closes it as Won't Fix (Not Reproducible). (https://www.bitdefender.com/en-us/blog/labs/ghostmap-android) - 2026-08-12: A packed banking dropper collected in the wild crashes Bitdefender's analysis emulators during install, and the team traces it to Android's handling of ZIP compression methods. (https://www.bitdefender.com/en-us/blog/labs/ghostmap-android) ## Fix brief # Security brief: Android GhostMap: installing a crafted app can trap a phone in a crash loop, and Google won't ship a security fix Source: https://pwn.watch/i/android-ghostmap-apk-zip-crash-loop-unpatched · status: live · severity: medium · updated Nov 5, 2026, 09:29 UTC ## Patch status **UNPATCHED: no fixed release yet. Apply mitigations and watch for updates.** ## What it is Bitdefender Labs disclosed GhostMap, an unpatched Android flaw in how the OS reads ZIP entries inside an APK. libziparchive only checks an entry's declared uncompressed size when the entry is marked stored, while libandroidfw maps any entry that is not marked deflated at that declared size. An entry with a third compression-method value passes both, so Android maps far more memory than the file has, and the first read past the real end of the file kills the reading process with a SIGBUS. If the malformed file is a resource that system_server reads, installing the app (no permissions, no code, never opened) leaves the phone in a boot crash loop that continues in safe mode; recovery takes a factory reset, or ADB only if USB debugging was already on. The same trick can crash the installer, the launcher and Settings screens used to uninstall an app, or security scanners. Bitdefender reproduced it on a Pixel 10 running Android 17 with the August 5, 2026 patch and says Android 10 and later are affected. Google closed the first report as Won't Fix (Not Reproducible) and called the second, with a working PoC, outside the scope of a security fix, passing it to a feature team. There is no CVE, and Bitdefender has not seen it used in the wild; the investigation began with a packed banking dropper that only crashed the installer. Severity detail: Persistent denial of service that can need a factory reset, but the victim has to install a crafted app; no code execution or data access, and no in-the-wild use seen - Product: Android (AOSP libziparchive / libandroidfw APK parsing) ## Affected versions - Android 10 and later (reproduced on a Pixel 10 with Android 17, August 5, 2026 security patch) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as unpatched. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes There is no Android patch. Install apps only from Google Play or other trusted stores and avoid sideloaded APKs. Bitdefender says its mobile scanner flags the malformed files (as Android.Riskware.Ghostmap), so a flagged download can be deleted before installing it. Keep a recent backup, since recovery from the crash loop can need a factory reset. ## Latest updates - Nov 5, 2026: Bitdefender publishes the GhostMap research; no fix or CVE exists and no in-the-wild use has been seen. - Aug 25, 2026: A second report with a working PoC of the persistent system_server crash loop is called outside the scope of a security fix and passed to a feature team for a possible future version. - Aug 20, 2026: Bitdefender reports the installer and parser crashes to Google's Android and Devices VRP; Google closes it as Won't Fix (Not Reproducible). - Aug 12, 2026: A packed banking dropper collected in the wild crashes Bitdefender's analysis emulators during install, and the team traces it to Android's handling of ZIP compression methods. ## Advisories - [GhostMap: The Android flaw that crashes your phone before you open the app](https://www.bitdefender.com/en-us/blog/labs/ghostmap-android) (Bitdefender Labs) ## Write-ups & news - [A banking malware sample led researchers to an Android bug that can loop-crash phones](https://www.helpnetsecurity.com/2026/11/05/ghostmap-android-bug-research/) - [GhostMap Android flaw lets malicious app trigger persistent boot loop](https://www.bleepingcomputer.com/news/security/ghostmap-android-flaw-lets-malicious-app-trigger-persistent-boot-loop/) - [Android GhostMap flaw could leave phones stuck in crash loops](https://www.androidauthority.com/android-ghostmap-vulnerability-crash-loop-3731355/) --- Machine-readable: https://pwn.watch/i/android-ghostmap-apk-zip-crash-loop-unpatched.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.