Research · 6 min read
GhostMap: a crafted Android app can crash a phone before you ever open it
Bitdefender showed that installing one permission-free app can trap Android 10 and later in a crash loop. Google has not shipped a security fix. The loop has not been seen in attacks.
Installing an app, and nothing more, can leave an Android phone stuck on the boot animation. Bitdefender Labs published that finding on November 5, 2026, under the name GhostMap. The app in their demonstration asks for no permissions and contains no executable code. You never have to open it. Google has told Bitdefender it will not fix this through a security update. Bitdefender has not seen anyone use the crash loop against a real phone.
What they demonstrated
The investigation started on August 12, 2026, when a banking dropper collected in the wild crashed Bitdefender’s analysis emulators during installation. The file had been rewritten by a packer, a tool Android malware often uses to make an app harder to inspect. That rewrite also broke the part of Android that reads an app as it is installed. Bitdefender says nothing in the sample suggests the author meant to crash anything. The sample never ran. The install simply failed.
Looking at why, the team found a bug in Android itself. An APK is a ZIP archive. Two of Android’s libraries disagree about an unusual entry in that archive: one checks a declared size only for the normal “stored” method, and the other treats anything that is not “deflated” as if it were stored, and maps the file as if it were that declared size. The kernel allows a map larger than the file. The first read past the real end of the file kills the process. Bitdefender’s capture on a Pixel 10 showed an 8,408-byte APK mapped across about 16 megabytes. The fault is a crash, not a way to run the attacker’s code, read data, or gain permissions.
Where the crash lands depends on which file inside the app is malformed:
- A bad manifest crashes the installer. That is all the original banking sample did. Nothing stayed on the phone.
- A bad resource that a core system service reads after installation crashes
system_server, the process that runs most of Android. Android restarts it, the service reads the same file again, and it crashes again. In one capture the cycle repeated 110 times, a few seconds apart, with the boot animation still on screen. From install to the first crash was about a second. - Any other process that reads the APK, including a security app scanning it, can be the one that dies.
Restarting does not clear it. Safe mode does not either: Bitdefender recorded 72 crash cycles in one safe-mode run, and the crash happened after the safe-mode flag was set but before it took effect. A computer can sometimes delete the file over USB debugging in the gaps between crashes, but only if developer mode was already on, and only before the first full reboot. After that, the crash comes too early. The recovery Bitdefender describes for a normal user is a factory reset, which erases data stored on the phone.
They reproduced this on a Pixel 10 running Android 17 with the August 5, 2026 security patch (build google/frankel/frankel:17/CP2A.260805.005/15828068), and on versions back to Android 10.
What Google said
Bitdefender reported the bug twice through Google’s Android vulnerability program.
- August 20, 2026: the first report, covering install-time crashes and crashes in apps that parse the file. Google closed it as “Won’t Fix (Not Reproducible)” and described it as outside the program’s scope.
- August 25, 2026: a second report, with a working demonstration of the persistent loop, a proof of concept, and the fact that the app needs no permissions and no code. Google said the issue was outside the scope of a security update, and that it had forwarded the finding to a feature team for possible inclusion in a future version.
Bitdefender notes that Google fixed a weaker cousin of this bug in 2016, CVE-2016-6724, rated Moderate, where a local app could force continual reboots and a factory reset was the remedy. Bitdefender says it has no CVE for GhostMap, because the report was not accepted as a vulnerability. At the end of October it told Google it would publish on November 5, and Google agreed. There is no patch as of that publication.
Bitdefender is explicit about the limit. The persistent loop is their own demonstration. They have not seen it used against anyone. The theoretical uses they describe (a phone that will not boot, an app whose icon crashes the screens you would use to uninstall it, a scanner that dies when it inspects the file, a malformation added later in an update) are illustrated so defenders understand the bug. They are not incidents. The bug does not execute code.
The banking dropper that started the work is a separate problem from the crash. That kind of malware, including trojans that abuse the Accessibility permission, is covered in our note on two Android banking trojans. GhostMap is not that.
What you can do
- Install apps from the store you already use, not from a file someone sent you. The crash requires a crafted APK. A random attachment or a “update” from a text is the delivery that matters. Play Protect and a store review are not a guarantee, but sideloading skips them.
- Keep a backup that is not only on the phone. If a factory reset is the way out, photos and files that exist only on the device are gone. The bug does not steal them. The reset deletes them.
- If a phone you own is already looping, a reset is the recovery Bitdefender found for people without USB debugging already turned on. Turning developer options on after the loop starts does not help.
- Do not pay anyone who offers to “unlock” a boot-looping phone by remote access. Bitdefender has not seen this used for extortion. A stranger asking for screen-sharing is a different scam.
Bitdefender Mobile Security detects the malformation as Android.Riskware.Ghostmap.rA in the company’s own testing. Android does not let a third-party app block an install or remove another app by itself, so a warning still needs a person to act, and the window can be about a second.
How Frame helps
This is a bug in the phone’s operating system, not a breach of an account. Frame cannot patch Android and does not see the file that would cause the loop. The steps above are the ones that apply.
Related coverage
- Two new Android banking trojans, one warning sign: the Accessibility permission: the sort of malware in the sample that led Bitdefender to this bug. That sample crashed on install. It is not the crash loop.
Sources
- Bitdefender Labs, GhostMap: The Android flaw that crashes your phone before you open the app, November 5, 2026
- Help Net Security, A banking malware sample led researchers to an Android bug that can loop-crash phones, November 5, 2026
More stories
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.