HighAPT
GhostMap Android Flaw Can Trap Phones in Endless Reboot Loops Without Opening an App
Cyber Security News·Source published ·1 min read
What happened?
A new Android bug named GhostMap can leave a phone stuck in a crash loop after a user installs a single crafted app. The app does not need to be opened, asks for no permissions, and contains no code. Researchers at Bitdefender Labs published the findings on November 5, 2026. They have not seen the trick used against real users. The analysis began on August 12, 2026, when an APK collected in the wild crashed the lab’s test emulators. The file was a banking dropper that never ran. It failed during installation. Bitdefender found the flaw in Android itself, not the malware.
Key details
- Android maps the file into memory at a false size, causing SIGBUS faults when processes read past the real file end.
- The crash hits system_server, a core service that repeatedly reads a resource file, crashes, restarts, and loops every few seconds.
- Safe mode fails to stop the loop because the service reads the file before safe mode takes effect.
Fixes and mitigations
- Google closed the initial report as Won't Fix and later said the issue is outside the scope of a security update, passing it to a team for a possible future release.
What to look for
- Security scanners that open the malicious file crash, potentially preventing detection.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.