Bitdefender disclosed GhostMap, an Android APK flaw that can boot-loop a Google Pixel 10 after one crafted app is installed; it reproduced the issue on Android 17. Bitdefender reports no in-the-wild use and says Google does not plan a security update.
The APK’s internal file map claims an entry is larger than the bytes actually present. Android accepts the mismatch and maps beyond the file; when a system process reads the missing data, it crashes. If the damaged entry is one that Android’s core system process rereads during startup, the phone crashes repeatedly, even in safe mode. Clearing the loop may require a factory reset that erases phone data.
For organizations managing Pixel 10s that allow APK installs, this puts device availability and data recovery at risk before an app runs or requests permissions. With no security update planned, the usual patch route is absent; Bitdefender has not established whether other Android models are affected.
Attackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed.