A flaw dubbed GhostMap lets attackers force Android devices into a continuous boot loop with a specially crafted app. The app needs no permissions and only has to be installed.
Discovery
Romanian security firm Bitdefender found the issue while analyzing an Android banking trojan that kept crashing its emulators when reading an app resource.
How It Works
Two Android libraries interpret ZIP compression methods differently. A malformed APK can bypass size checks and map a file beyond its actual contents. Reading that region causes a SIGBUS crash in any process that touches it.
After installation, the core service system_server reads the malicious resource, crashes, and restarts into the same loop. The malicious app contains no executable code and does not need to be launched. Safe Mode is also blocked.
Bitdefender's test device was a Pixel 10 on Android 17 with the August 5 security patch. The full range of affected versions has not been defined, and no CVE was mentioned.
Vendor Response
Bitdefender reported the issue on August 20 and received a "Won't Fix (Not Reproducible)" reply. It resubmitted an extended report on August 25. Google deemed the issue out of scope for a security update but kept it for future consideration. BleepingComputer was still awaiting Google's comment on the fix status.
Recovery and Mitigation
- Factory reset works but erases local data.
- Deleting the malformed file via ADB requires USB debugging to be enabled beforehand, and must happen before the crash loop starts.
- Blocking the app at installation is the only reliable point of prevention. Third-party security tools can warn users but cannot block the install.
Recommendations
- Install apps only from trusted sources such as Google Play.
- Avoid sideloading APKs from unknown origins.
- Keep regular device backups so a factory reset is survivable.
- For managed fleets, restrict app installation through MDM policy.