Bitdefender's GhostMap bug lets a permission-free Android app trap phones in a boot loop, and Google won't issue a security fix
The crafted app does not need to be opened, and getting the phone out of the loop can take a factory reset.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Bitdefender researchers have disclosed GhostMap, an Android flaw that lets a specially crafted app push a device into a continuous boot loop. The app contains no executable code, requests no permissions and does not need to be launched. It only has to be installed. The flaw comes from two Android libraries that interpret ZIP compression methods inside an APK differently. That mismatch lets a malformed package get past size checks and be mapped beyond the file's real contents. Any process that reads the affected entry crashes with a SIGBUS signal. Bitdefender reproduced the loop on a Pixel 10 running Android 17 with the August 5, 2026 security patch. Clearing it can require a factory reset, which erases data stored on the phone. The researchers found the problem on August 12, when a banking dropper collected from the wild crashed their analysis emulators during installation. Bitdefender says it has not seen the technique used in attacks. According to Help Net Security, Google closed Bitdefender's August 20 report as Won't Fix (Not Reproducible). Google then answered an August 25 follow-up that included a working proof of concept by calling the issue outside the scope of a security fix and passing it to a team for possible inclusion in a future Android version. Until then, Android users have no security patch for this denial-of-service risk.