GhostMap Android flaw can trap phones in a crash loop: how to protect yourself
Bitdefender found GhostMap, an Android flaw that can trap phones in an endless crash loop just by installing a crafted app. Google hasn't fixed it. Here's how to stay safe and what to do if it happens.
Security researchers at Bitdefender have found an Android flaw called GhostMap that can trap a phone in an endless crash loop. A specially made app only needs to be installed; you don’t even have to open it. The loop survives restarts and even safe mode, and in many cases the only way out is a factory reset that erases everything stored on the phone. Google has not released a fix. Here’s what you need to know and how to protect yourself.
What is GhostMap?
GhostMap is a denial-of-service flaw. It doesn’t steal your data or give hackers control of your phone. Instead, it makes the phone unusable. According to Bitdefender:
- The malicious app needs no permissions and no harmful code.
- Simply installing it can trigger the problem.
- The phone keeps crashing and restarting, and safe mode doesn’t help.
- Recovery may require a factory reset, which deletes photos, messages and other local data that aren’t backed up.
“Installing a specially crafted app can leave an Android phone stuck in a crash loop, with no way back except a factory reset.” Bitdefender Labs
Which phones are affected?
According to Bitdefender, GhostMap affects Android 10 and later. That covers most Android phones in use today. The researchers reproduced it on a Pixel 10 running Android 17 with the August 5, 2026 security patch, and on older devices too.
How was it found?
Bitdefender researcher Alecsandru Cătălin Daj started investigating on August 12, 2026, after a piece of banking malware kept crashing the company’s test systems while it was being installed. Bitdefender describes the crash as an unintended bug in that malware, not a deliberate attack feature. The researchers then figured out why it happened.
How does it work? (simple version)
Android apps are packaged as APK files, which are a type of ZIP file. Two parts of Android read these files in slightly different ways:
- One part checks the size of a file inside the package only in certain cases.
- Another part trusts the size written in the package without checking it.
A badly formed package can slip past the first check. When the second part tries to read data that isn’t really there, it crashes. If that crash happens inside system_server, the core process that runs Android, the phone restarts, reads the same file again, and crashes again, over and over.
What did Google say?
Bitdefender reported the flaw to Google twice:
- August 20, 2026: Google closed the first report as “Won’t Fix (Not Reproducible)” and said it was outside its bug reward program.
- August 25, 2026: After a second report with a working demo, Google said the issue was outside the scope of a security update and passed it to a team for possible consideration in a future Android version.
As of publication, no fix is available, and Bitdefender has not seen GhostMap used in real attacks. Google had not commented publicly in the reports we reviewed.
How to protect your phone
Because there is no patch, prevention matters most:
- Install apps only from the Google Play Store or other trusted stores.
- Don’t install APK files from websites, messages, emails or social media links, especially ones that promise free premium apps or mods.
- Keep “Install unknown apps” turned off. Go to Settings, search for “Install unknown apps”, and make sure no app has permission unless you really need it.
- Back up your phone regularly. If you ever need a factory reset, a backup means you won’t lose your photos and messages. Our guide shows how to back up your phone.
- Keep Android updated for protection against other threats. See our guide to the November 2026 Android update.
What to do if your phone is stuck in a crash loop
- If you had USB debugging turned on before the problem started, a technician (or a tech-savvy friend) may be able to remove the bad app using a computer and Android Debug Bridge (ADB). According to the researchers, this depends on timing and may stop working after a full reboot.
- Otherwise, a factory reset is likely the only fix. You can usually start one from the phone’s recovery menu (often by holding the power and volume buttons while the phone is off; the exact keys depend on the brand).
- After the reset, restore from your backup and don’t reinstall the app that caused the problem.
- If you’re unsure, contact your phone maker or carrier before resetting.
What it means for you
GhostMap won’t steal your banking details, but losing every photo and message on your phone is still a serious problem. The good news: you’re very unlikely to be affected if you only install apps from trusted stores and keep a recent backup. Those two habits also protect you from much more dangerous threats, like the phone exploits we covered this week.
Frequently asked questions
What is the GhostMap Android vulnerability?
GhostMap is a flaw in how Android reads app package files. A specially made app can trigger an endless crash loop just by being installed, and recovery may require a factory reset.
Which Android versions are affected by GhostMap?
According to Bitdefender, Android 10 and later are affected, including Android 17 on a Pixel 10 with the August 2026 security patch.
Has Google fixed GhostMap?
No. Google told the researchers the issue was outside the scope of a security update and might be addressed in a future Android version. No fix is available yet.
Can GhostMap steal my data?
No. GhostMap makes the phone unusable rather than stealing data. The main risk is losing data that isn’t backed up if you have to factory reset.
