Bitdefender says a flaw in Android can turn one app install into a phone that never finishes booting. The test app asks for no permissions, holds no code and does not even need to be opened. Once it is installed, a restart does not clear the problem, and neither does safe mode. The usual cure is wiping the phone, and Google has told the researchers it will not treat this as a security fix.
Bitdefender has named the flaw GhostMap. Its team reproduced it on a Pixel 10 with Android 17 and the August 2026 security patch, and says every Android release from version 10 up is affected. The company says it has seen no attacks using the technique.
It began on 12 August with a piece of banking malware that kept breaking Bitdefender’s emulators. That sample never got as far as running; it failed while installing. The cause turned out to be Android’s own handling of the files packed inside an APK. The package code validates an entry’s claimed size only when the entry is marked as stored, meaning uncompressed. Another part decides how to read an entry by asking whether it is compressed with the standard method. An entry that claims some other method passes the first test unchecked and then gets read as if it were uncompressed, so Android reserves far more memory than the file contains. As soon as a process reads beyond the real end of the file, it is killed.
Which process goes down depends on what is reading. With the installer, the install just fails, as it did for the malware. Bitdefender then built a version in which the broken file is one that a core service opens when it walks through the installed apps. The service sits in system_server, a central Android process. It crashes, restarts, reads the file again and crashes again, every few seconds, and the phone never reaches the home screen. Nothing on screen points to the app responsible.
Getting out is awkward. If USB debugging happened to be on already, a computer using ADB may manage to delete the file in the gaps between crashes. Bitdefender says even that stops working after the first full reboot.
Bitdefender’s technical write-up lists other ways to use the same malformed entry. A rogue app could also corrupt its own icon. Every screen that draws the icon, including the launcher and Settings, would then crash, so the owner could not reach the usual uninstall buttons. Security scanners that open the file would die on it as well. Bitdefender stresses that these are possibilities, not attacks it has seen. The bug only crashes processes; it gives an attacker no access to data and no extra permissions.
The company reported the problem to Google’s Android and Devices vulnerability reward programme on 20 August and again on 25 August. The first report was closed as Won’t Fix (Not Reproducible). The second report included a working demonstration. Google replied that a security update was not the place for a fix, and said a feature team would look at it for some later Android version. Bitdefender notes that Google fixed a milder version of this kind of bug in 2016 (CVE-2016-6724) and rated it Moderate, and argues that Google’s current severity rules would call a factory-reset condition High.
No patch exists yet. Bitdefender says its own Mobile Security app flags files with this malformation, though Android gives third-party apps no power to stop an install, so the user has to react to the warning in time.
