Installing a single app that contains no code and asks for no permissions can leave an Android phone stuck restarting forever, with a factory reset as the only reliable way out. Bitdefender Labs researcher Alecsandru Cătălin Daj calls the flaw GhostMap, and says Google has declined to fix it through a security update.
The app never has to be opened. A core Android system process reads a booby-trapped file inside it, crashes, restarts, reads the file again and crashes again. Rebooting does not help and neither does safe mode. Bitdefender reproduced the loop on a Pixel 10 running Android 17 with the August 5, 2026 security patch, and says every version from Android 10 onward is affected.
A malware sample that broke the lab
The research began on August 12, 2026, when a banking dropper collected in the wild crashed Bitdefender's analysis emulators during installation. The sample had been wrapped by a packer, a tool that scrambles an APK's internal structure to frustrate reverse engineering. That rewrite happened to trip a bug in Android itself. Bitdefender says nothing suggests the malware's author knew it; the sample only ever caused a failed install.
The flaw lies in how Android trusts two fields in each ZIP entry of an APK: the compression method and the declared uncompressed size. Android's libziparchive library checks that declared size against the real file only for entries marked as stored, and skips the check for other method values. A separate component, libandroidfw, then maps or copies memory based on that unchecked size, running past the end of the file and triggering a SIGBUS crash, the signal a processor raises when a program reads memory that does not exist.
Turning a failed install into a bricked phone
Which process dies depends on which file is malformed. A broken manifest only crashes the installer. Bitdefender's own escalation, which it stresses has not been seen in attacks, targets small resources that system services inside system_server read after installation. Corrupt one of those and the heart of Android crashes on every start. The researchers outline other abuses: a malicious app could malform its own icon so the launcher and Settings crash whenever a user tries to uninstall it, or crash security scanners and sandboxes that try to inspect it. The bug does not run code, read data or grant permissions. It is a denial-of-service flaw.
Google says no security fix is coming
Bitdefender reported the issue on August 20 and again on August 25, 2026, the second time with a working proof of concept. Google first closed it as not reproducible and out of scope, then said it fell outside a security update and passed it to a feature team for a possible future release. Bitdefender points out that Google treated a similar reboot-loop flaw, CVE-2016-6724, as a security issue in its November 2016 bulletin. Parser disagreements of this kind have a long history on Android, from Master Key in 2013 to Janus in 2017. We have also covered other malformed-file crashes on Android this year.
No patch, so avoid unknown APKs and keep USB debugging in mind
With no fix available, the practical defence is to stop the file before it is read. Bitdefender says the malformation is visible in the APK's structure without running it, and that its own mobile product detects it. Avoid sideloading apps from outside trusted stores. If a phone does fall into the loop and USB debugging was already enabled, ADB can sometimes delete the offending file between crashes, but only until the first full reboot. Otherwise the fix is a factory reset, so recent backups matter more than ever.
A bug that destroys no data directly can still cost a user everything on the phone, and that is the gap between how Google scored it and how a victim would.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.