GhostMap Android flaw can trap phones in endless reboot loops
- Severity
- High
- Sources
- 1
What happened
GhostMap is an Android parsing flaw in which a crafted APK entry with an odd compression method value is read differently by two Android libraries, so the mapped size exceeds the real file. Reads past the end trigger SIGBUS, and a service in systemserver crashes repeatedly at boot. Bitdefender Labs tested this on a Pixel 10 running Android 17 with the August 5, 2026 patch and reports the affected range starts at Android 10. No CVE or fix exists; Google passed the report to a team for a possible future release. Defenders should block sideloaded APKs, and ADB-enabled devices may be recoverable by deleting the file, which carries its own risk.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Install apps only from trusted stores and avoid sideloaded APK files.
- Be aware that a factory reset is the only reliable recovery if the phone is stuck in a boot loop, and it erases local data.
- Treat enabling USB debugging for recovery as a risk, since it has its own security downsides.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies