GhostMap Android vulnerability causes smartphones to crash
A new vulnerability in Android allows smartphones to be permanently trapped in a crash loop. Simply installing a prepared app is enough. There is no need to open it; usually only a factory reset helps.
Danger even during installation
Versions Android 10 up to the current Android 17 are affected. The devices get into an endless crash loop without users having to open the app. This neither requests permissions nor contains executable code. After each restart, a central system process tries again to access the faulty resources. This causes the device to keep crashing. Safe mode doesn’t help either. Those affected usually only have the option of resetting to the factory settings, whereby all locally stored data will be lost. Only if USB debugging has been activated beforehand can the faulty file be removed via a computer.
Android’s old ZIP problems
The vulnerability known as GhostMap was discovered by Bitdefender. The security researchers came across this in August 2026 while analyzing a banking Trojan. The cause is the processing of ZIP archives, which also include APK installation files. Two system libraries interpret information about the compression method and the extracted file size differently. This causes the system to load a file into an unallocated memory area. If a process accesses it, the processor aborts the process with an error. Such differences in file processing have led to vulnerabilities in Android for more than a decade. Master Key from 2013 and Janus from 2017 already took advantage of the fact that Android components read the same ZIP container differently.
No patch in sight
So far, no attacks using GhostMap have been observed. However, criminals could use the technology to lock devices for extortion or to crash security programs during scanning. Despite multiple reports from the discoverers, Google rejected a short-term security update. The company classified the bug as not qualifying for a patch, but wants to check it for future Android versions.
Interestingly, Google has already fixed a less severe version of this vulnerability. From the November 2016 security bulletin, CVE-2016-6724: A denial of service vulnerability in the Input Manager Service could allow a malicious local application to trigger a continuous device reboot. This issue is rated as Moderate because it is a temporary denial of service that requires a factory reset to resolve.
Priti Rajpoot is a technology journalist and contributor at ResearchSnipers, covering the latest in tech news, innovation, and digital trends across the world. From startups and AI to cybersecurity and consumer gadgets. She can be reached here: priti.r@researchsnipers.com
