GhostMap: Android bug can force a phone into a crash loop
A flaw in Android can leave a phone repeatedly crashing after a specially crafted app is installed, even if the user never opens it or
A flaw in Android can leave a phone repeatedly crashing after a specially crafted app is installed, even if the user never opens it or grants permissions, Bitdefender Labs researchers say. Recovering may require a factory reset, which erases data stored on the device.
The problem, dubbed GhostMap, is in Android’s handling of two fields in a ZIP file entry: its compression method and declared uncompressed length. Bitdefender said reading a malformed entry can trigger a SIGBUS error, causing a system process to crash.
How the crash loop starts
Bitdefender said its researchers began investigating on August 12, 2026, after an APK collected in the wild crashed emulators in their lab. The sample was a banking dropper, but the researchers found that the Android operating system—not code running in the app—caused the failure.
The specially crafted file can trigger the problem during installation. A core system process then crashes and restarts, repeating the cycle. The app does not need to be opened, and the user does not need to grant it permission.
“The malformed entry causes Android to map the file across memory that was never allocated,” Bitdefender said. The crash follows when a process tries to read from that unallocated space.
Recovery can erase local data
Restarting the phone does not stop the loop, Bitdefender said, and the crash continues in safe mode. The standard recovery option is a factory reset, which erases locally stored data.
There is a narrower alternative for users who had already enabled USB debugging before the failure: Bitdefender said a computer running Android Debug Bridge could be used to delete the file before the phone reboots.
The reports do not identify specific Android models or operating-system versions affected. Bitdefender’s findings describe an operating-system flaw triggered by a crafted APK, rather than a problem limited to the banking app used in its investigation.
