GhostMap Android Flaw Can Trap Phones in Endless Reboot Loops Without Opening an App
GhostMap Android flaw traps phones in endless reboot loops via malicious APK installation without user interaction.
Researchers at Bitdefender Labs discovered GhostMap, a critical Android vulnerability that can trap a device in an infinite crash loop after installing a crafted APK that requires no permissions, no user interaction, and contains no executable code. The flaw exploits a parsing inconsistency in Android's ZIP/APK handling, causing the system_server process to repeatedly crash and restart. Google classified the issue as outside the scope of security updates and has not issued a fix or CVE, leaving Android 10 and later versions vulnerable.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe GhostMap vulnerability exposes a critical flaw in Android's ZIP/APK parsing logic that can render any device running Android 10 or later permanently unusable through an infinite reboot loop — without requiring any permissions, user interaction, or executable code. What makes this especially dangerous is Google's decision to classify it outside the scope of security updates, meaning no CVE has been issued and no patch is forthcoming, leaving hundreds of millions of devices in a sustained vulnerable state. This highlights the significant risk posed when a platform vendor declines to remediate a confirmed, researcher-verified vulnerability, forcing organizations and users to rely on alternative mitigations. The incident underscores the importance of maintaining robust mobile device management policies and third-party APK controls even when official patches are unavailable.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — GhostMap
- cve — CVE-2016-6724