New Android exploit only needs you to install an app to wreck your phone

Affiliate links on Android Authority may earn us a commission. Learn more.

New Android exploit only needs you to install an app to wreck your phone

Nov 5, 2026 — 4:00 AM ET

- Bitdefender researchers discovered an Android vulnerability that can trigger an endless crash loop simply by installing a specially crafted APK, potentially leaving devices unusable.

- The flaw exploits how Android handles ZIP compression methods, repeatedly crashing the core system_server process. Recovering may require a factory reset or manually deleting the malicious file using ADB.

- No in-the-wild exploitation has been identified, but the public disclosure could make it easier for threat actors to develop an exploit.

Even though Android is a relatively safe operating system, with several security measures in place, threat actors’ ingenuity still keeps finding ways to exploit weaknesses. We recently shared information about malware that can empty your bank accounts in secret, and now, researchers have found a separate Android flaw that could leave your phone outright unusable.

Normally, malicious apps need to request permissions and execute code to attack your device. However, researchers at Bitdefender have discovered a new vulnerability dubbed GhostMap that triggers a crash loop simply by installing a specially crafted app.

Investigation surrounding GhostMap first began in August, after analyzing a malicious banking-related APK found in the wild. The APK crashed emulators in Bitdefender’s analysis, though the problem wasn’t necessarily any malware in the app — the problem was Android itself. The crashes were a result of Android’s handling of ZIP entry compression methods. Essentially, the operating system misinterprets information about how files inside an APK are compressed, which could be used to trigger a system crash.

After finding the underlying issue, the researchers developed a specially crafted APK to demonstrate how the vulnerability could be exploited and used to crash devices. Installing the APK repeatedly crashes system_server, a core Android process.

“It crashes, Android restarts it, and on restart the service goes through the installed apps again, reads the same file again, and crashes again. The phone never finishes starting. This is the crash loop: system_server dies and restarts every few seconds, with no app ever opened and nothing on screen to say which app is responsible,” reads Bitdefender’s report about the vulnerability.

This isn’t out there (yet)

The vulnerability wasn’t spotted being exploited in the wild. The researchers simply highlighted that a specially crafted APK can easily trigger this behavior, and recovering from the crash loop might not be easy. It involves either factory resetting your device or deleting the malicious file with ADB.

Bitdefender has reported the issue to Google through the Android & Devices Vulnerability Reward Program. Twice, for that matter. Google closed the first report with the status Won’t Fix (Not Reproducible). The second report, complete with a working proof of concept and reproduction instructions, reportedly resulted in Google saying that the issue was “outside the scope of a security update fix.”

The tech giant reportedly forwarded the finding to “the relevant team for review,” though no fix has been made available yet.

With Bitdefender’s report now out in public, GhostMap is no longer just a finding known to security researchers. Threat actors could use the new knowledge to start finding ways to reproduce and exploit the vulnerability, potentially putting users at a greater risk. The exploit being public should also put more pressure on Google to issue a fix before it is potentially exploited.