GhostMap Android Bug: How to Avoid the Boot Loop (No Patch)

GhostMap is an unpatched Android bug that lets a booby-trapped app put a phone into a crash loop the moment it’s installed. The app doesn’t need to be opened and asks for no permissions. Once the loop starts, restarting and Safe Mode don’t help, and the only reliable fix Bitdefender found is a factory reset, which erases everything stored only on the phone.

Bitdefender Labs published the research on November 5, 2026. There is no fix from Google yet, so protection comes down to what you install and whether your data is backed up. This guide explains what GhostMap does, which phones are affected, and the settings to check today.

Before you start

Who this affects: phones running Android 10 or later, including the latest Android 17
Is there a patch: no, not as of November 5, 2026
Seen in real attacks: no, according to Bitdefender
Time needed: about 10 minutes to check your settings and backup

What GhostMap does

Every Android app is a ZIP file with an .apk extension. Inside it, each file records how it’s compressed and how large it should be once unpacked. Bitdefender found that two parts of Android disagree about how to treat a compression type that is neither “stored” nor “deflated”. One part skips its size check for those entries, and the other trusts the declared size anyway.

A crafted app can claim that a tiny file is about 16 MB. When Android reads past the real end of that file, the process reading it crashes with a memory error (SIGBUS). If the file is one that system_server, the core process that runs most of Android, reads automatically after an install, the result is a loop: system_server crashes, restarts, reads the same file and crashes again.

In Bitdefender’s tests on a Pixel 10 running Android 17 with the August 5, 2026 security patch, the first crash came about one second after installation. The loop repeated 110 times in one normal boot capture and 72 times in Safe Mode. The screen stayed on the boot animation the whole time.

Why Safe Mode and restarting don’t fix it

Safe Mode normally stops third-party apps from running, which is why it’s the usual first step for a phone that keeps rebooting. GhostMap gets around it because the malicious app never runs. Android itself reads the bad file before Safe Mode takes effect.

Bitdefender identified only two ways out:

Factory reset from the phone’s recovery menu. This works, but it deletes apps, local photos, downloads and anything not backed up.
Deleting the file over ADB from a computer. This only works if USB debugging was already turned on before the problem started, and Bitdefender says it stops working after the first full reboot because the crash then happens too early in startup.

Which phones are affected

Bitdefender reproduced the bug on Android versions starting with Android 10, up to Android 17. That covers almost every Android phone still getting updates, from Google Pixel to Samsung Galaxy and other brands. Phones older than Android 10 weren’t part of the testing.

Question	Answer as of November 5, 2026
—	—
Android versions affected	Android 10 through Android 17
Security patch that fixes it	None released
Permissions the app needs	None
Does the app need to be opened	No, installing it is enough
Can it steal data or run code	No, it causes crashes only
Seen in real attacks	Not observed by Bitdefender

What Google has said

Bitdefender reported the issue through Google’s Android vulnerability reward program on August 20, 2026. Google closed it as “Won’t Fix (Not Reproducible)”. Bitdefender sent an expanded report with a working proof of concept on August 25. Google then said it was outside the scope of a security update and passed it to a product team for possible inclusion in a future Android release.

BleepingComputer asked Google about a fix and had not received a reply when it published on November 5. We’ll update this article if Google ships a patch.

How to protect your Android phone from GhostMap

Because there’s no patch, these steps limit the chance of installing a crafted app and reduce the damage if you do.

1. Don’t install apps from outside Google Play

The original sample Bitdefender found was a banking malware dropper, the kind usually spread as an APK file through links in texts, chat apps and fake websites. Avoid installing APK files sent to you, even from people you know.

2. Turn off “Install unknown apps” for every app

On a Pixel, go to Settings > Apps > Special app access > Install unknown apps. Open each app in the list, especially browsers, messaging apps and file managers, and make sure Allow from this source is off. Samsung and other brands use similar wording, though the menu path can differ slightly.

3. Keep Google Play Protect on

Open the Play Store, tap your profile picture, then Play Protect > Settings (the gear icon), and confirm Scan apps with Play Protect is on. Play Protect was not built to detect GhostMap specifically, so treat it as a general safety net. Bitdefender says its own Mobile Security app flags these files as Android.Riskware.Ghostmap.rA, but no Android security app can block an install on its own. You still have to act on the warning before installing.

4. Check what Google already backs up

If a factory reset becomes the only fix, your backup decides what you lose. Go to Settings > Google > All services > Backup (on some phones the menu is called Google services) and check the dates under Backup details. Google’s backup doesn’t cover everything, so also check WhatsApp’s own chat backup, your two-factor app and any files in your Downloads folder. For a full copy of your Google data, see our guide to backing up your Google account with Takeout.

5. Know your Google account password

After a factory reset, Android asks for the Google account that was on the phone before it will finish setup. Confirm you can sign in to that account on another device, and set up two-step verification backups so you aren’t locked out at the same time your phone is.

If your phone is already stuck in a crash loop

A phone that reboots over and over has many possible causes, from a failed update to a hardware fault. GhostMap is only one. If the loop started right after you installed an app from outside Google Play:

Try a normal restart and Safe Mode first. If either works, uninstall the most recently installed app.
If USB debugging was already on and you know how to use ADB, deleting the bad app file from a computer may work before the next full reboot. Most people won’t have this set up.
If nothing else works, factory reset the phone from the recovery menu. The key combination depends on the manufacturer, so check your phone maker’s support site.
After the reset, sign in with your Google account and restore your backup. Don’t reinstall the app that caused the problem.

FAQ

Can GhostMap steal my data?

No. Bitdefender says the bug crashes processes but doesn’t run code, read data or gain permissions. The damage is data loss from the factory reset, not theft.

Is my iPhone affected by GhostMap?

No. GhostMap is a flaw in how Android parses app packages. iPhones use a different system.

Will the November 2026 Android security update fix GhostMap?

Not according to what’s public. Google told Bitdefender the issue is outside the scope of a security update. Install the November 2026 Android security update anyway, since it fixes other serious flaws.

Can a GhostMap app get into Google Play?

Bitdefender hasn’t seen it there. It notes in theory that a malformed file could be added through a later app update, which is why Play Protect and a current backup still matter.

What to do next

Spend ten minutes today: turn off unknown app installs, confirm Play Protect is on and check your backup date. If you want a refresher on suspicious apps, read our guide to spotting fake apps on Google Play.

How we checked this: technical details and the disclosure timeline come from Bitdefender Labs’ report published November 5, 2026, cross-checked with BleepingComputer’s coverage the same day. Settings paths come from Google’s Android and Google Play help pages. We did not reproduce the attack.