GhostMap Android Vulnerability Can Trigger Persistent Boot Loops Without App Permissions - Cybersecurity Insiders
Security researchers at Bitdefender Labs have discovered an Android vulnerability called GhostMap that can render smartphones unusable simply by installing a malicious application.
The vulnerability exploits inconsistencies between Android's libziparchive and libandroidfw libraries, which handle APK file structures differently. By manipulating an APK entry's compression method and declared uncompressed size, attackers can cause a critical system process to crash repeatedly, preventing the device from completing startup.
Unlike previous Android vulnerabilities that focused on bypassing security checks or concealing malicious code, GhostMap exploits parsing inconsistencies to crash processes handling malformed APK resources. The vulnerability was reproduced on a Pixel 10 running Android 17 with the August 5, 2026 security patch.
Security Implications
Although GhostMap does not enable arbitrary code execution, data theft, or privilege escalation, researchers identified several denial-of-service scenarios. Attackers could disable Android devices, interfere with application removal, or crash security tools that inspect malformed APK files.
The investigation began on August 12, 2026, when an APK containing a banking malware dropper caused Bitdefender's analysis emulators to crash during installation. Bitdefender emphasized that it has not observed GhostMap being deliberately exploited in real-world attacks.
Google's Response
Bitdefender reported its findings to Google on August 20 and August 25, 2026, through the Android & Devices Vulnerability Reward Program. Google initially closed the report as Won't Fix (Not Reproducible), but after a second submission with a working proof of concept, indicated the issue was outside the scope of a security update.
Google indicated that the issue was outside the scope of a security update and had been forwarded for possible consideration in a future Android release.
Mitigation Options
At the time of Bitdefender's publication, no security fix was available. The researchers noted that restarting the device or entering safe mode does not resolve the issue, and recovery may require a factory reset, potentially erasing locally stored data.
In limited circumstances, Android Debug Bridge (ADB) may allow the affected file to be removed if USB debugging was previously enabled. Bitdefender Mobile Security can identify affected applications and warn users, though Android's security restrictions prevent third-party apps from independently blocking installations.
Related
