US antitrust attorneys want a judge to keep the option of forcing Google to also sell its Android mobile operating system, which powers most of the world's smartphones
Android GhostMap Flaw Can Trap Phones in Endless Crash Loops, Forcing Factory Resets, Researchers Warn AFP

Security researchers have disclosed an unpatched Android flaw that can leave a phone stuck in an endless crash loop after a user simply installs a malicious app, with a data-erasing factory reset often the only fix.

The exploit, dubbed GhostMap, can cause persistent denial of service across all Android releases since Android 10.

Researchers at Bitdefender Labs said a crafted app "can leave an Android phone stuck in a crash loop," even if users never open it or grant it permissions.

How it works

GhostMap stems from inconsistent handling of ZIP entries by two Android libraries, libziparchive and libandroidfw. By creating a malformed Android package file, attackers can bypass size checks and map files into unallocated memory regions, triggering a SIGBUS signal that causes the system_server process to crash repeatedly.

In one test, an APK of 8,408 bytes was mapped across about 16 MB.

The danger is significant because the app does very little. It does not need to be opened, asks for no permissions and contains no code.

No memory is corrupted; this is an over-read, not code execution.

Testing

Bitdefender tested the flaw on a Pixel 10 running Android 17 with the Aug. 5, 2026 patch; the first crash came about one second after install, and one capture showed 110 repeats, while a safe mode run showed 72.

The flaw sits in Android's core. Bitdefender researcher Stahie said "the bug is present in AOSP," adding that the team tested from Android 10 up to the latest version but did not test on phones from other manufacturers.

Discovery

The analysis began on Aug. 12, 2026, when an APK collected in the wild crashed the lab's test emulators; the file was a banking dropper that failed during installation.

Recovery

Safe mode fails because the service reads the file before safe mode takes effect, and a factory reset works but erases local data. Recovery through Android Debug Bridge may be possible if USB debugging was already enabled, but researchers say this is timing-dependent.

Potential abuse

A rogue app could lock a phone and then demand money, or damage its own icon so the launcher and Settings crash when a user tries to remove it. Security scanners that open the file would crash as well, so the app might never be flagged.

No fix yet

Bitdefender reports no fix as of publication and has not observed the persistent crash loop being used in attacks. Google initially classified the report as not reproducible.

Users should install apps only from trusted sources and be cautious with sideloaded files until a fix is available.