A banking malware sample led researchers to an Android bug that can loop

Bitdefender Labs researchers built an Android app that contains no executable code and requests no permissions, and installing it leaves a Pixel 10 in a crash loop that can take a factory reset to clear. The flaw, which Bitdefender calls GhostMap, comes from how Android reads the ZIP structure inside an APK.

The app does not need to be opened. The team reproduced the loop on a Pixel 10 running Android 17 with the August 5, 2026 security patch, and a factory reset erases the data stored on the phone. Bitdefender has not observed anyone using the technique in the wild.

Bitdefender says Google does not plan a security update. The first report, sent August 20, was closed as Won’t Fix (Not Reproducible). Google answered the August 25 follow-up, which included a working proof of concept, by calling the issue outside the scope of a security fix and passing it to a team for possible inclusion in a future version.

It started with a banking dropper

On August 12, a banking dropper collected from the wild crashed Bitdefender’s analysis emulators during installation. A packer, a tool that rewrites an APK’s internal structure to keep reverse-engineering tools out, had wrapped the sample, and the rewrite also broke Android’s installer.

Two libraries, one gap

Each entry in a ZIP file declares a compression method and an uncompressed size. Android supports two methods, stored and deflated. The field is 16 bits wide, so a file can declare something else entirely. One Android library checks the declared size only for stored entries. A second treats anything not deflated as stored and maps the file into memory at the declared size. An entry with a third method value passes both.

The kernel allows a mapping larger than the file. In Bitdefender’s capture, an 8,408-byte APK was mapped across 16 MB, and the first read past the real end of the file triggers a SIGBUS, a CPU fault that kills the process doing the reading.

Which process dies depends on which file is malformed. A bad manifest crashes the installer. A bad resource read by system_server, the process hosting most of Android, crashes it on each restart, because it rereads the same file. One capture shows 110 cycles with the boot animation stuck on screen, and safe mode runs the same loop.

Asked how this differs from earlier Zimperium research on malformed APKs, Silviu Stahie , a security analyst at Bitdefender said: “In the Zimperium research, the malformed APKs only crashed analysis tools and resisted decompilation, but those applications ran OK on device. We found a way to exploit that parser gap further and trigger an out-of-bounds (OOB) read and SIGBUS in the caller process. In some cases, that process is the Android system process itself.”

On reach, Stahie said: “Yes, the bug is present in AOSP and we tested starting from Android 10 up to the latest version. Since this is present in the base Android, we didn’t test on phones from other manufacturers.”

The big open question is whether a booby-trapped app could get past app store review and sneak onto phones later through an update. Bitdefender floats that possibility, then stops short of saying whether it’s realistic.

“We have a good reason not to expand on this specific point in the research. Details circumventing audit controls for an unpatched vulnerability may be considered evidence of misuse (Directive 2013/40/EU),” Stahie told Help Net Security. The research does not say whether Google Play review would catch such a file.

Bitdefender has no CVE for the bug. “Had they accepted the bug through the vulnerability program , we would have had a CVE. At the end of October, we informed them our plans to publish the research on November 5th and they agreed,” Stahie said.