Bitdefender Labs disclosed a GhostMap Android flaw on 5 November 2026 that can crash-loop Android 10 and newer phones. Installing one crafted app is enough; the app needs no permissions and never has to be opened.
Google has not shipped a fix. Bitdefender says Google closed its first report as “Won’t Fix (Not Reproducible)”. After a second, expanded report, Google told Bitdefender the finding would not get a security update, though it was passed to a feature team for a possible future Android version.
What Is the GhostMap Android Flaw?
Bitdefender traces the crash to how Android reads the compression details stored inside an app’s installation file. Two internal Android components can read the same file entry differently. One checks an entry’s declared size only for certain storage methods; the other skips that check for any entry marked a different way.
Bitdefender says an entry that falls into this gap makes Android treat a small file as if it were much larger than it is. The process reading the file crashes once it reaches past the file’s real end. Android sends it a SIGBUS, the signal the operating system uses when a process reaches memory that was never there.
Who Is Exposed?
Bitdefender says the flaw affects every Android version from Android 10 and above. The team reproduced it on a Pixel 10 running Android 17 with Android’s 5 August 2026 security patch, and on several older releases too.
What Can the GhostMap Bug Do?
Bitdefender names three uses for the flaw. A malformed resource file can crash a core system service into a repeating boot loop. The phone never finishes starting, and only a factory reset clears it, erasing the phone’s data. Bitdefender says this capability could be misused for extortion.
A malformed icon file can make a malicious app hard to remove. The launcher and the uninstall screen both crash when they try to show the icon, so the usual paths to deleting the app fail first. A malformed file can also crash a security scanner that inspects the app, so the scanner dies before it can flag anything.
Bitdefender says it has not observed any of these three uses against real devices. On its own, the bug crashes a process; it does not run code, read data or gain extra permissions.
What Does Bitdefender Recommend Right Now?
Bitdefender’s own Mobile Security product detects this malformation and warns the user, whether the file arrives as a download or as an already-installed app. Bitdefender detects it as Android.Riskware.Ghostmap.rA.
Android’s own rules limit what a security app can do next. Bitdefender says Android’s security model does not let a third-party app block an installation or remove another app by itself. Acting on the warning still rests with the phone’s owner.
- Keep mobile detection turned onA security app that can flag a malformed file before installation is the main defense while Google has no fix out; this step is our own advice.
- Delete a flagged file before installing itIf a download or update is flagged, remove it before opening it. Bitdefender says the warning only helps if you act on it, since the app never needs to run.
- Use a factory reset to recover a stuck phoneBitdefender says restarting and safe mode do not stop the loop. A factory reset is the way back, and it erases the phone’s data.
- Try ADB only if it was already onBitdefender says that if USB debugging was already enabled, a connected computer can sometimes delete the file between crashes, before the first full reboot; it does not work after that.
As of this writing, Bitdefender’s post gives the flaw no CVE id, and Google has not set a fix date. For another Android patch story from the same month, see Android’s November 2026 security bulletin. GhostMap grew out of a malware sample that would not install, and Bitdefender separately warns that a working crash loop could be misused for cyber extortion.