Bitdefender Labs said on 5 November 2026 that installing a specially crafted Android app can leave a phone stuck in a crash loop even if the app is never opened and requests no permissions; the app contains no executable code. Bitdefender calls the flaw GhostMap: Android mishandles the compression method and declared uncompressed length of a ZIP entry, so a malformed APK entry is mapped across memory that was never allocated, and reading it causes a SIGBUS crash in whichever process touches the file.

Bitdefender says that if the malformed file is a resource that a core system service reads, system_server crashes and restarts repeatedly, the loop continues after a reboot and in safe mode, and recovery may require a factory reset that erases local data, unless USB debugging was already on and ADB can delete the file between crashes. It reproduced this on a Pixel 10 running Android 17 with the 5 August 2026 security patch and says it affects Android 10 and above.

Bitdefender says the investigation began on 12 August when an in-the-wild banking dropper APK crashed its analysis emulators during installation, but nothing in that sample suggests its author knew it would crash anything; the crash-loop escalation is Bitdefender's own work and it has not seen it used against anyone.

It says the bug crashes processes but does not execute code, read data or gain permissions. Bitdefender reported the issue to Google on 20 and 25 August; Google first closed it as Won't Fix (Not Reproducible) and out of scope, and, according to Bitdefender, said in its second response that it will not be addressed through a security update and was referred to a feature team for possible consideration in a future version.

Bitdefender says no fix is available as of publication. (source: Bitdefender Labs) BleepingComputer says it asked Google about the fix status and was waiting for a reply. (source: BleepingComputer)