Follow us on Google News
A newly disclosed Android security vulnerability can leave smartphones trapped in a continuous restart cycle after users install a specially crafted application, even if they never open the app or grant it any permissions.
Cybersecurity researchers at Bitdefender revealed the flaw, named GhostMap, on November 5, 2026, warning that affected devices may become unusable and require a factory reset that erases locally stored information.
The vulnerability affects Android’s handling of application files. Researchers reproduced the problem on a Google Pixel 10 running Android 17 and identified the underlying weakness in versions dating back to Android 10.
Bitdefender reported the issue to Google in August, but said the company had declined to address it through a security update.
The researchers have not observed criminals exploiting the persistent crash-loop technique against users. Their findings demonstrate a security weakness that could potentially be misused to disrupt devices or threaten victims with data loss.
Malicious App Needs No Permissions To Crash Android
Most Android malware attacks depend on persuading users to open an application, approve dangerous permissions or provide sensitive information.
GhostMap works differently.
The researchers created a demonstration application containing no executable code and requesting no permissions.
Simply installing the specially constructed application was enough to trigger the vulnerability.
The problem originates in the way Android processes APK files, the format used to distribute and install Android applications.
These files contain software components and resources stored using a structure similar to compressed ZIP archives.
According to the researchers, two Android software libraries interpret certain file information differently.
One library checks whether the size of a file entry is valid, while another uses that information to decide how much of the file should be mapped into memory.
A specially constructed APK can exploit the disagreement by declaring a file size larger than the information actually available.
When Android attempts to read the missing portion, the affected process crashes.
In the demonstration, the researchers placed the malformed information inside a resource automatically examined by system_server, a critical Android process responsible for numerous operating-system functions.
Because Android repeatedly tries to restart this process, it encounters the same malformed resource and crashes again.
The result is a continuous cycle that prevents the phone from completing its normal startup.
Safe Mode Cannot Stop The Restart Cycle
Bitdefender tested the vulnerability using a Pixel 10 running Android 17 with the August 5, 2026 security patch.
The first crash occurred approximately one second after the malicious demonstration app was installed.
During testing, researchers recorded 110 consecutive crash cycles in normal operation.
They also observed 72 crashes while testing Safe Mode, which normally allows Android users to troubleshoot problematic applications.
The phone remained stuck on its startup animation, preventing ordinary access to its functions.
Restarting the device did not resolve the problem because Android continued attempting to process the same malformed file.
Researchers identified two potential recovery methods.
The first was a factory reset, which restores the phone to its original software state but removes locally stored applications and data.
The second involved Android Debug Bridge, or ADB, a developer tool that allows a computer to communicate with an Android device.
In limited circumstances, ADB could be used to delete the malformed file before the system crashed again.
However, this method requires USB debugging to have been enabled beforehand, and the available time to remove the file is extremely limited.
Bitdefender warned that once the device completes a full reboot, even this recovery method may become unavailable.
The findings raise concerns about the potential consequences of installing untrusted applications, particularly for users who do not maintain regular backups.
Google Declined Security Update After August Reports
The investigation began on August 12, when Bitdefender examined an Android banking-malware sample collected from the wild.
The sample caused the company’s analysis systems to crash while attempting to inspect its application files.
Further examination revealed that the failure originated from Android’s own file-processing behaviour rather than the malware’s intended banking-related functions.
Researchers subsequently developed a separate demonstration capable of repeatedly crashing a core operating-system service.
Bitdefender first reported the vulnerability to Google on August 20 through its Android vulnerability disclosure programme.
According to the researchers, Google closed the initial report with a designation indicating that the issue could not be reproduced.
An expanded report followed on August 25, including additional technical evidence and instructions demonstrating the persistent restart cycle.
Bitdefender said Google again considered the issue outside the scope of a security update, although it forwarded the findings for possible consideration in a future Android release.
As of the November 5 public disclosure, the researchers said no fix was available.
Google had not provided BleepingComputer with a further response before its report was published.
The absence of a security update does not mean every Android phone has been demonstrated to be exploitable in identical conditions.
Bitdefender confirmed the underlying weakness across Android 10 and later versions, but did not individually test every manufacturer’s devices.
Researchers Have Not Found Active GhostMap Attacks
The initial banking-malware sample found in the wild could disrupt application analysis and installation, but Bitdefender found no indication that its creator deliberately intended to exploit GhostMap.
The more severe, persistent restart-loop technique was developed during the researchers’ investigation.
No confirmed victim cases involving that technique have been reported.
The flaw also differs from spyware or banking malware because it does not independently provide access to passwords, financial information or private messages.
Its demonstrated impact is denial of service: preventing someone from using their device.
Researchers warned that criminals could theoretically exploit this weakness through fraudulent applications or use the threat of permanent data loss for extortion.
However, those scenarios remain hypothetical rather than documented attacks.
The discovery highlights how vulnerabilities in the operating system itself can create risks even when an application does not request sensitive permissions or execute ordinary malicious code.
What This Means For You:
Avoid installing APK files from unknown websites, messages or unfamiliar senders, and maintain regular backups of important phone data. If a device becomes trapped in repeated restarts, seek qualified technical assistance before attempting a factory reset that could erase personal files.
