GhostMap Cripples Android Smartphones: Why Google Hasn’t Closed the Flaw Yet

TVS News AI, editorially supervised, presents GhostMap Cripples Android Smartphones: Why Google Hasn’t Closed the Flaw Yet.

On August 20 and 25, 2026, Bitdefender reported the Android vulnerability GhostMap to Google. Two weeks later, there was still no official security patch. In the security researchers’ tests, simply installing a specially prepared app was enough to send a Pixel 10 running Android 17 with the security update from August 5, 2026 into a recurring reboot loop.

At first, this sounds like classic malware. GhostMap is unusual, however, because the prepared app does not request any permissions and does not run any obviously malicious code. Instead, the trigger is hidden in a malformed file embedded in the app’s code.

A File Sends Android Into a Reboot Loop

Two faulty pieces of information trigger the crash

According to Bitdefender, Android misinterprets two pieces of information in the manipulated file: the compression method used and the size the file should have after being extracted. As a result, the system attempts to read beyond the end of the actual file and crashes. The name GhostMap describes this mechanism precisely: The faulty file causes Android to use a memory area that was never allocated.

The crashing process is called system_server. It is part of Android’s core services and, according to Bitdefender’s observations, stops every few seconds. At the same time, the smartphone restarts, without the user even having to open an app. After the restart, the next crash follows. Neither a normal restart nor Safe Mode can break the device out of this loop: The service reads the manipulated file before Safe Mode can even take effect.

This makes GhostMap more than a brief app crash. The app only needs to be installed. From then on, the smartphone keeps rebooting without ever booting up normally.

Android 10 and Newer: The Scope Is Significantly Wider

All versions since Android 10 are affected

Bitdefender was able to reproduce the loop on a Pixel 10 with Android 17. According to the security company, all Android versions since Android 10 are affected. The vulnerability therefore extends far beyond a single device type or a single release of Android.

The researchers do not specify any restriction to particular manufacturers in their report. Nor does the technical trigger require any special permission: The manipulated file is already embedded in the app and is processed by Android as soon as the device processes the installed app.

Bitdefender also describes a scenario that goes beyond a single download: An app that is already installed could be supplied with the faulty file during a routine update. In theory, this could allow for wider distribution. According to the researchers, however, no such case has been observed so far. Likewise, there is currently no indication that GhostMap has been actively exploited.

Reset or ADB: How to Get Out

Resetting to factory settings erases everything

According to the Bitdefender researchers, there is only one reliable way out of the reboot loop: resetting the device to factory settings. This resolves the lockout but also deletes all data stored on the smartphone.

There is one exception for users who have enabled ADB, the Android Debug Bridge, in advance. According to Bitdefender, a computer system connected via ADB can sometimes remove the manipulated file between two crashes. However, this is not guaranteed. In addition, Developer Options must already have been enabled beforehand. Anyone who has not set this up will lose their data along with the reset.

A simple restart does not help because the core Android service, system_server, keeps crashing. Safe Mode also comes too late: It only takes effect after the affected service has already read the file.

Google Rejects Two Security Updates

No Fix in the Current Security Update

At the first report on August 20, 2026, Google moved the case into its own “Won’t Fix (Not Reproducible)” category: The issue was therefore deemed not reproducible. After the second report on August 25, 2026, the company said the bug was outside the “scope of security updates.” In its second response, the company also explicitly said the issue would not be addressed through a security update.

Google did, however, refer the case to a different team. According to the Bitdefender researchers, that team might fix the vulnerability in a future version of Android. No commitment to do so has been made yet. For the time being, the bottom line is clear: No security patch is available.

The cautious response has one clear consequence for you: Once the loop has been triggered, you cannot rely on a regular Android update to remove the lockout. According to the researchers, anyone who has already triggered the vulnerability is practically left with a reset or the prepared ADB route.

GhostMap Also Prevents Easy Removal

The malicious app can remain installed

Another issue affects uninstallation. According to Bitdefender, all removal methods can fail before the malicious app is actually deleted. It therefore remains installed on the device and can continue to function. Bitdefender also raises the possibility that GhostMap can cause certain security tools to crash while scanning an app.

This makes the vulnerability relevant to extortion scenarios as well. Attackers could lock a smartphone and then demand money from the victim. Bitdefender warns that such a capability could be misused as leverage in extortion operations. The report does not document any concrete, active extortion cases.

For everyday use, the source sticks to a deliberately simple recommendation: Use well-known, reputable apps from the Play Store and avoid APKs downloaded directly from the web. In addition, 01net recommends backing up your data regularly. This backup is particularly relevant in the case of GhostMap because the official escape route—resetting to factory settings—erases everything on the device.

The technical assessment and information about Google’s decision come from 01net’s report on the GhostMap vulnerability.