A malicious app can force an Android device into a persistent restart loop simply by being installed, without requesting permissions or being opened, Bitdefender researchers found, as reported by BleepingComputer on November 5. Recovering from the flaw, dubbed GhostMap, can require a factory reset that erases locally stored data unless debugging access was already enabled.
Bitdefender demonstrated the problem on a Pixel 10 running Android 17 with the August 5 security patch. Its demonstration app contained no executable code and needed no user interaction after installation. The researchers discovered the flaw while examining an Android banking trojan that repeatedly crashed their emulators when reading an application resource.
Bitdefender says it reported GhostMap to Google in August, but Google classified the issue as not reproducible and did not release a patch. The exploitation described in the report is Bitdefender’s demonstration, rather than a documented attack campaign.
How installation triggers the crashes
GhostMap stems from two Android libraries interpreting ZIP compression methods differently. A malformed APK—an Android application package—can exploit that disagreement to bypass size checks, causing Android to map a file into memory beyond its actual contents.
When a process reads the invalid region, it receives SIGBUS, a signal that stops a process attempting an invalid memory access. Any process that touches the affected file can crash, the researchers said.
For its demonstration, Bitdefender included a resource that Android’s core system_server service automatically reads after installation. Reading it crashes the service. When the service restarts, it reads the same resource and crashes again, creating the persistent loop.
On the test Pixel, crashes began about one second after installation. The researchers recorded 110 repetitions in normal boot mode and 72 in safe mode. Bitdefender warns that the loop also prevents users from accessing Safe Mode, normally a route for troubleshooting and recovery.
Google’s response and recovery options
Bitdefender first reported the issue to Google on August 20 and received a “Won’t Fix (Not Reproducible)” response that treated it as out of scope. Believing Google had misclassified the report, the researchers submitted an expanded version on August 25.
Google still considered the issue outside the scope of a security update, though it reserved it for consideration in a future update, Bitdefender said. BleepingComputer had asked Google about the fix status and was awaiting a response when its article was published.
Bitdefender says the opportunity to stop the attack is during installation. Third-party security tools may detect the threat and display a warning, but lack permission to block installation.
For users whose devices are already caught in the loop, the reported recovery options are a factory reset or deleting the malformed file through Android Debug Bridge (ADB), a debugging tool. ADB recovery requires debugging to have been enabled beforehand, and removal scripts must act before the system crashes again. A factory reset erases all locally stored data.
