Skip to content
GhostMap Android Flaw Causes Persistent Boot Loop from Malicious Apps

GhostMap Android Flaw Causes Persistent Boot Loop from Malicious Apps

First seen 5 Nov 2026, 10:45 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 5, 2026 at 10:46 UTC
  • •The GhostMap vulnerability allows malicious apps to cause a persistent boot loop on Android devices.
  • •Bitdefender discovered the flaw during analysis of a banking trojan that crashed their emulators.
  • •Google has classified the issue as 'not reproducible' and has not issued a security patch.

Researchers from Bitdefender discovered a vulnerability in Android, dubbed GhostMap, that allows malicious apps to trigger a persistent boot loop without requiring any permissions. The flaw stems from how Android interprets ZIP compression methods in APK files, enabling an attacker to craft an APK that maps beyond its actual size, leading to a SIGBUS error when the system attempts to read from unallocated memory. This issue affects devices running Android 10 and above, specifically demonstrated on a Pixel 10 with Android 17. Google has been aware of this issue since August 2026 but has classified it as 'not reproducible' and has not released a patch. Users can only recover their devices through a factory reset or by using ADB commands, which require prior debugging settings. No has been reported in the wild, but the potential for abuse exists.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2h ago How this analysis works

Timeline

2026-08-12
Banking dropper crashes emulators
Bitdefender's analysis emulators crashed during the installation of a banking dropper, leading to the discovery of the GhostMap vulnerability.
Helpnetsecurity
2026-08-20
GhostMap reported to Google
Bitdefender reported the GhostMap vulnerability to Google, but it was closed as 'Won't Fix (Not Reproducible)'.
Bleepingcomputer
2026-08-25
Follow-up report submitted
Bitdefender submitted a follow-up report with a proof of concept, but Google still deemed it out of scope for a security update.
Helpnetsecurity

More articles in this cluster (4)

Following this threat?

Track GhostMap in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

Which Android versions are affected?
The GhostMap vulnerability affects devices running Android 10 and above, including Android 17.
Is there a patch available?
No, Google has classified the issue as 'not reproducible' and has not released a patch.
How can users recover from the boot loop?
Users can recover their devices through a factory reset or by deleting the malformed file using ADB commands.