Romanian security firm Bitdefender has discovered an Android flaw, dubbed GhostMap, that lets a malicious app with no permissions and no need to be launched force a device into a continuous boot loop, and says Google closed the issue without a patch after replying 'Won't Fix (Not Reproducible)'.
The flaw stems from two Android libraries that interpret ZIP compression methods differently, allowing a malformed APK (Android package file) to bypass size checks and be mapped beyond the file's actual contents. "Reading such an entry causes a SIGBUS (a signal sent by the CPU to stop a process that accesses an invalid memory space) in whichever process touches the file," the researchers say.
Bitdefender said it uncovered GhostMap while analyzing an Android banking trojan that kept crashing its emulators when it tried to read an application resource. To demonstrate the crash-loop effect, the company created an app containing a resource that the core Android service 'system_server' automatically attempts to read after installation. The read triggers the flaw and restarts the process, which reads the same resource and crashes again in an endless loop.
During tests on a Pixel 10 running Android 17 with the August 5 security patch, the device began the crash loop about one second after installation, with the sequence repeating 110 times in normal boot mode and 72 times in safe mode. Bitdefender warns that the boot loop also prevents users from accessing Safe Mode, the usual route for troubleshooting and restoring a device.
Stopping the crashes is possible in two ways: a factory reset, which erases all locally stored data, or deleting the malformed file through ADB, which requires the debugging option to already be active on the device. Restoring via ADB also requires scripts to act before the system crashes.
Bitdefender reported the issue to Google on August 20 and received a "Won't Fix (Not Reproducible)" reply, with the issue declared out of scope. The researchers submitted an extended version on August 25, believing Google had misclassified the original report, but the company still deemed it out of scope for a security update, while reserving it for consideration in a future update. BleepingComputer has asked Google about the fix status and was still awaiting a reply.
Bitdefender says the only chance to block the attack is during installation, noting that third-party security tools may detect a possible threat and display a warning, but do not have permission to block installation.
Analysis
Why This Matters
- A single app that requests no permissions and is never opened can make a phone unusable, and the crash loop blocks Safe Mode, the standard recovery route.
- With no patch from Google, affected users face either a factory reset that wipes local data or an ADB recovery that must be configured in advance.
- The flaw was found only because a banking trojan kept crashing Bitdefender's emulators, a reminder that malware analysis can surface unreported weaknesses in core platforms.
Background
Android is Google's mobile operating system and runs on the majority of smartphones worldwide. It allows users to install applications from outside the official Play Store, a practice known as sideloading that security researchers have long associated with higher malware risk. Bitdefender is a Romanian cybersecurity company that develops antivirus and endpoint protection products.
Key Perspectives
Bitdefender: says GhostMap allows a permission-free, never-launched app to force a device into a continuous boot loop, believes Google misclassified its original report, and says the only way to block an attack is at installation.
Google: replied "Won't Fix (Not Reproducible)" to the August 20 report and twice deemed the issue out of scope for a security update, while reserving it for consideration in a future update.
What to Watch
- Whether Google issues a patch in a future Android update, having reserved GhostMap "for consideration" after twice ruling it out of scope.
- Whether the banking trojan behaviour that led to the discovery indicates malware in the field can already trigger the flaw.
- Whether third-party security vendors begin detecting the malformed-APK pattern, given that they can warn users at install time but cannot block the installation.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe researchers said: “Reading such an entry causes a SIGBUS (a signal sent by the CPU to stop a process that accesses an invalid memory space) in whichever process touches the file,”BleepingComputer: “"Reading such an entry causes a SIGBUS (a signal sent by the CPU to stop a process that accesses an invalid memory space) in whichever process touches the file," the researchers say.”
- SupportedGoogle replied, “Won't Fix (Not Reproducible)”.BleepingComputer: “Bitdefender reported the issue to Google on August 20, but received a “Won’t Fix (Not Reproducible)” reply, with the issue being out of scope.”
- SupportedBitdefender discovered the Android flaw and dubbed it GhostMap.BleepingComputer: “Romanian cybersecurity company Bitdefender discovered the flaw while analyzing an Android banking trojan”
- SupportedA malicious app that needs no permissions and does not need to be launched can force an Android device into a continuous boot loop.BleepingComputer: “Attackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed.”
- SupportedThe flaw stems from two Android libraries interpreting ZIP compression methods differently, allowing a malformed APK to bypass size checks and be mapped beyond its actual contents.BleepingComputer: “GhostMap stems from two Android libraries that interpret ZIP compression methods differently. This allows a malformed APK (Android package file) to bypass size checks and be mapped beyond the file’s actual contents.”
- SupportedBitdefender found the flaw while analyzing an Android banking trojan that kept crashing its emulators when it tried to read an application resource.BleepingComputer: “Romanian cybersecurity company Bitdefender discovered the flaw while analyzing an Android banking trojan that kept crashing its emulators when it tried to read an application resource.”
- SupportedOn a Pixel 10 running Android 17 with the August 5 security patch, the crash loop began about one second after installation and repeated 110 times in normal boot mode and 72 times in safe mode.BleepingComputer: “The device started the crash string about one second after installing the app, the loop repeating for 110 times in normal boot mode and 72 times in safe mode.”
- SupportedBitdefender warned that the boot loop prevents users from accessing Safe Mode, which would normally help troubleshoot and restore the device.BleepingComputer: “Bitdefender warns that the boot loop also prevents users from accessing Safe Mode, which would normally provide a way to troubleshoot the problem and restore the device.”
- SupportedThe crashes can be stopped by a factory reset, which erases locally stored data, or by deleting the malformed file through ADB; ADB requires debugging to already be active, and restoration scripts must act before the system crashes.BleepingComputer: “Stopping the crashes is possible in two ways: a factory reset, which erases all locally stored data, and by deleting the malformed file via ADB. However, using ADB requires the debugging option to already be active on the device. Additionally, restoring via ADB requires the scripts to act before the system crashes.”
- SupportedBitdefender reported the issue to Google on August 20, submitted an extended version on August 25, and says Google still considered it out of scope for a security update while reserving it for possible consideration in a future update.BleepingComputer: “Bitdefender reported the issue to Google on August 20, but received a “Won’t Fix (Not Reproducible)” reply, with the issue being out of scope. The researchers submitted an extended version on August 25, believing Google misclassified the original report. The tech giant still deemed it out of scope for a security update, though it reserved it for consideration in a future update.”
- SupportedBleepingComputer had asked Google about GhostMap's fix status and was still waiting for a reply.BleepingComputer: “BleepingComputer has reached out to Google asking about the fix status for GhostMap, but we are still waiting for a reply.”
- SupportedBitdefender says the only chance to block the attack is during installation; third-party security tools may detect a threat and display a warning but cannot block installation.BleepingComputer: “Bitdefender says the only chance to block the attack is during installation, noting that third-party security tools may help detect a possible threat and display a warning, but do not have permission to block installation.”
