---
title: Bitdefender GhostMap: a malformed APK can put Android 10+ into a persistent boot loop — install is enough, no permissions or code needed | ctxsec
url: https://ctxsec.com/items/bitdefender-ghostmap-android-zip-crash-loop-nov-5
description: "Bitdefender Labs says a specially crafted Android package can crash system_server in a loop after install, even if the app is never opened and requests no permissions. Reproduced on a Pixel 10 running Android 17 (Aug 5, 2026 patch) and on Android 10+. Restart and safe mode do not clear it; recovery may need a factory reset, or ADB deletion if USB debugging was already on. The bug is a parser differential on ZIP entry compression method vs declared uncompressed length (libziparchive vs libandroidfw). Google closed Bitdefender's VRP reports as outside a security-update fix and referred them to a feature team. Bitdefender has not seen the persistent loop used in the wild; the seed sample was a banking dropper that only crashed installers."
status: "confirmed research (Bitdefender Labs, Nov 5); Google assessed outside security-update scope; no in-the-wild boot-loop exploitation reported"
published: 2026-11-05
---

> Bitdefender Labs says a specially crafted Android package can crash system_server in a loop after install, even if the app is never opened and requests no permissions. Reproduced on a Pixel 10 running Android 17 (Aug 5, 2026 patch) and on Android 10+. Restart and safe mode do not clear it; recovery may need a factory reset, or ADB deletion if USB debugging was already on. The bug is a parser differential on ZIP entry compression method vs declared uncompressed length (libziparchive vs libandroidfw). Google closed Bitdefender's VRP reports as outside a security-update fix and referred them to a feature team. Bitdefender has not seen the persistent loop used in the wild; the seed sample was a banking dropper that only crashed installers.

[← Cybersecurity News](/news) · [markdown](/items/bitdefender-ghostmap-android-zip-crash-loop-nov-5.md)

confirmed research (Bitdefender Labs, Nov 5); Google assessed outside security-update scope; no in-the-wild boot-loop exploitation reported

2026-11-05

### Bitdefender GhostMap: a malformed APK can put Android 10+ into a persistent boot loop — install is enough, no permissions or code needed

- **Risk scenarios Bitdefender outlines (hypothetical):** disable a phone as extortion leverage; malform an app's own icon so Settings/launcher crash before uninstall; crash scanners that parse the APK.
- **Defense today:** prefer sideload caution; Bitdefender Mobile Security flags the malformation as Android.Riskware.Ghostmap.A — act on the warning before install finishes.
- No CVE assigned in the public write-up; Google has not published a security bulletin entry.

Sources: [Bitdefender Labs: GhostMap — The Android flaw that crashes your phone before you open the app (Nov 5)](https://www.bitdefender.com/en-us/blog/labs/ghostmap-android) · [BleepingComputer summary](https://www.bleepingcomputer.com/news/security/ghostmap-android-flaw-lets-malicious-app-trigger-persistent-boot-loop/)