A newly identified vulnerability in the Android operating system, dubbed “GhostMap,” allows a malicious application to trap a device in a persistent boot loop immediately after installation. The flaw, which requires no special permissions to execute, affects virtually all modern versions of the OS, from Android 10 through the current Android 17 release.
According to a technical report published by Bitdefender on November 5, 2026, the vulnerability stems from a fundamental disagreement between two Android system libraries regarding how ZIP compression fields are interpreted. When a malicious APK contains a malformed ZIP entry—specifically one where the compression method and uncompressed length fields are manipulated—the system_server process attempts to read the resource and triggers a SIGBUS signal. This occurs because the CPU attempts to access unallocated memory, causing a critical system crash.
Because the system_server process is integral to the Android boot sequence, the crash occurs before the user can even open the malicious application. On a Pixel 10 running Android 17, researchers observed the flaw triggering approximately 110 reboot cycles in normal mode before the system potentially stabilized or remained stuck.
The Failure of Safe Mode
The GhostMap flaw is particularly disruptive because it bypasses the standard “Safe Mode” recovery environment. Safe Mode is designed to boot the operating system without loading third-party applications, allowing users to uninstall problematic software. However, the system_server process attempts to parse the resources of all installed APKs early in the boot process, regardless of whether the device is in Safe Mode.
Testing showed that even in Safe Mode, the Pixel 10 underwent roughly 72 reboot cycles. This leaves most victims with only one viable recovery option: a full factory reset, which results in the loss of all local data not backed up to the cloud. For advanced users, the loop can potentially be broken using the Android Debug Bridge (ADB) to manually delete the malformed file, but this requires USB debugging to have been enabled and authorized prior to the attack.
Google’s Response and Patch Status
Despite Bitdefender providing a working proof-of-concept that triggers the loop, Infosecurity Magazine reports that Google has twice declined to issue a patch. The issue was first reported to Google on August 20, 2026, but the company closed the ticket as “Won’t Fix,” stating the flaw was “not reproducible” and outside the scope of its security reward program.
As a result, no CVE (Common Vulnerabilities and Exposures) identifier has been assigned to the flaw. Google’s classification likely stems from the fact that the crash occurs during resource parsing rather than via arbitrary code execution. While the flaw results in a permanent Denial of Service (DoS) for the hardware, it does not directly allow an attacker to steal data or gain root access.
The lack of an OS-level patch means the primary line of defense is currently Google Play Protect. While Play Protect may be updated to flag applications using these specific malformed ZIP structures, users who sideload APKs from third-party sources remain at high risk. As PCMag notes, the flaw could also be used by malware to “crash” security sandboxes and automated analysis tools designed to scan for malicious behavior, as those tools would also fall into a boot loop when attempting to process the file.