Installing an app can be enough to trigger GhostMap, an Android denial-of-service flaw described in Bitdefender’s November 5 research. Its demonstration needs no executable app code, requested permissions or launch.
Android misinterprets malformed APK resource metadata. Automatic resource reads trigger a core-service crash loop that survives reboot and safe mode.
The investigation began on August 12 with a banking-dropper sample found in the wild. That sample crashed the installer; the persistent loop was developed by researchers, who report no observed attacks using it.
Bitdefender reports reproduction from Android 10 onward, including Android 17 on a Pixel 10 with the August 5, 2026 patch. It reports no available fix at publication. Recovery may require a factory reset that erases local data; flagged APKs should be rejected before installation.
