Bitdefender researchers uncovered an Android flaw that allows a specially crafted app to trigger a persistent system crash loop simply by being installed.
Dubbed ‘GhostMap,’ the denial-of-service issue can leave affected phones unusable even after a restart or after entering safe mode. According to Bitdefender, recovery may require a factory reset that erases locally stored data.
Researcher Alecsandru Cătălin Daj says the investigation began on August 12, 2026, after a banking dropper collected in the wild crashed the company’s analysis emulators during installation.
Android application packages, or APKs, are ZIP archives containing an app’s code, resources, and configuration files. The dropper used a packer to obscure its internal structure, inadvertently exposing a flaw in how Android processes those archives.
That original sample only caused failed installations. The researchers developed the persistent crash loop separately as a proof of concept.
Conflicting file checks
GhostMap stems from inconsistent handling of ZIP entries by two Android libraries, libziparchive and libandroidfw.
The first checks an entry’s declared uncompressed size against the available file space only when its compression method is explicitly marked as ‘stored.’ The second treats any method other than ‘deflated’ as stored, using the declared uncompressed length to map the entry into memory.
An entry specifying an unsupported compression method can therefore bypass the size check while still being mapped using an inflated length. When a process reads beyond the actual file contents, Android terminates it with a native SIGBUS fault.
The impact depends on which component reads the malformed resource. A damaged manifest can crash installation, while a resource read automatically after installation can bring down system_server, the process hosting core Android services.
When that process restarts, it encounters the same installed app and crashes again. Bitdefender’s demonstration required no executable code, no app launch, and no permissions, with the first crash occurring roughly one second after installation.
The researchers reproduced the issue on Android 10 and later, including a Pixel 10 running Android 17 with the August 5, 2026 security patch.
Google declines security fix
Bitdefender says it reported the initial findings to Google on August 20. Google closed that submission as ‘Won’t Fix (Not Reproducible)’ and described it as outside the reward program’s scope.
A second submission on August 25 included the persistent crash-loop proof of concept and reproduction instructions. According to Bitdefender, Google considered the issue outside the scope of a security update and forwarded it to a team for possible consideration in a future version.
Bitdefender reports no fix as of publication and has not observed the persistent crash loop being used in attacks in the wild. Potential abuse includes disrupting security scanners or crashing app-management screens to obstruct removal. The flaw itself does not execute code, steal data, or grant additional permissions, but it can still cause severe disruption and data loss.
Users should avoid installing unfamiliar APKs and maintain backups of important local data. Bitdefender says structural scanning can identify crafted files before installation, although third-party security apps cannot independently block installation or remove another app.
Recovery through Android Debug Bridge may be possible during the crash loop if USB debugging was already enabled, but the researchers say this is timing-dependent and can stop working after a full reboot. Otherwise, a factory reset will work, but that erases all locally stored data.
Leave a Reply