GhostMap: an app can brick Android device, leaving it in crash loop

Bitdefender Labs stumbled onto a silent killer for Android phones while analyzing a banking‑trojan sample that repeatedly crashed their emulators. The flaw – dubbed GhostMap – does not need any permissions, user interaction, or even executable code. As soon as the malicious APK is installed, the operating system reads a malformed resource and the core system service "system_server" crashes, prompting an immediate reboot that repeats forever. The result is a device stuck in a boot‑loop that survives ordinary restarts, safe mode, and even a quick power cycle.

The root cause lies in an inconsistency between two Android libraries that unpack ZIP archives – libziparchive and libandroidfw. One library validates the declared uncompressed size of a ZIP entry only when the compression method is marked as "stored," while the other treats any non‑deflated method as stored and trusts the length field. By crafting an entry that declares an unsupported compression method but an inflated uncompressed length, an attacker can bypass the size check. When the system later maps the entry into memory, it over‑allocates, and any read beyond the real data triggers a native SIGBUS fault. "Reading such an entry causes a SIGBUS," the researchers noted, and the offending process is terminated.

Bitdefender reproduced the attack on a Pixel 10 running Android 17 with the August 5, 2026 security patch, as well as on devices running Android 10 and later. After installation, the first crash occurs in about a second, and the loop repeats roughly 110 times in normal mode and 72 times in safe mode before the device becomes unusable. Because the malicious file remains on the system, a simple reboot does not break the cycle. The only reliable remedies are a factory reset – which erases all user data – or, in a narrow window, using Android Debug Bridge (ADB) to delete the offending APK while USB debugging is already enabled. That latter method fails after a full power‑off because the debugging session ends before the crash can be intercepted.

The vulnerability does not grant an attacker access to photos, messages, or accounts; it is a pure denial‑of‑service. Nevertheless, the researchers outlined plausible abuse scenarios: an extortionist could threaten victims with a bricked phone unless a ransom is paid, or a malicious actor could silently cripple security‑scanning tools by crashing the Settings or launcher screens that display app icons, effectively hiding the offending app from removal. Despite the high‑impact nature of the bug, Google classified the report as "Not Reproducible" and out of scope for an immediate security update, opting instead to flag it for possible inclusion in a future Android release. As of this writing, no public patch exists, and the security community has only limited mitigation – mainly vigilance against installing unknown APKs and maintaining regular backups.

Bitdefender’s submissions on August 20 and August 25 were both dismissed as out of scope, leaving enterprises and consumers to rely on procedural safeguards. Until a patch materializes, the practical advice remains: avoid sideloaded apps, keep USB debugging disabled by default, and ensure that critical data is backed up to a cloud or external storage solution that can survive a forced factory reset. The GhostMap episode underscores how low‑level library disagreements can translate into high‑profile service outages, reminding the Android ecosystem that even mature platforms harbor hidden, destructive seams.