Vulnerabilities · 23h ago
Bitdefender disclosed GhostMap, an Android APK flaw that can boot-loop a Google Pixel 10 after one crafted app is installed; it reproduced the issue on Android 17. Bitdefender reports no in-the-wild use and says Google does not plan a security update.
The APK’s internal file map claims an entry is larger than the bytes actually present. Android accepts the mismatch and maps beyond the file; when a system process reads the missing data, it crashes. If the damaged entry is one that Android’s core system process rereads during startup, the phone crashes repeatedly, even in safe mode. Clearing the loop may require a factory reset that erases phone data.
For organizations managing Pixel 10s that allow APK installs, this puts device availability and data recovery at risk before an app runs or requests permissions. With no security update planned, the usual patch route is absent; Bitdefender has not established whether other Android models are affected.
3 sources covering this story
GhostMap Bug Leaves Android Phones Stuck in Reboot Loop
Bitdefender warns that unfixed GhostMap bug could force users to factory reset their device
GhostMap Android flaw lets malicious app trigger persistent boot loop
Attackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed.
The GhostMap Android bug lets a no-code app trap a Pixel 10 in a crash loop.
Part of the PlainSec briefing for 2026-11-06