GhostMap: Android Flaw Can Trap Phones in a Crash Loop Only a Factory Reset Fixes

Bitdefender researchers have disclosed a vulnerability in Android they have named GhostMap. They found it after a suspicious app file collected from the wild crashed the emulators in their lab. On investigation, the problem was not malware but a flaw in the Android operating system itself. Android mishandles two fields inside a ZIP entry, the compression method and the declared uncompressed length. When any process reads such a file, it crashes.

The impact is serious. Bitdefender says the crash loop continues after a reboot and even in safe mode, so the only way out is a factory reset, which erases all locally stored data. The flaw affects Android 10 and above. Bitdefender notified Google on August 20, but according to the report Google has not addressed it, saying the issue falls outside the scope of a security fix. Bitdefender warns that criminals could theoretically hide the technique in a fake app to disable a victim's phone, or use it as leverage for extortion.

Because there is no patch, options on the device are limited. Bitdefender says the most practical defence is to spot the crafted file before the bug is triggered. The malformation is visible in the file's structure, so a security scanner can identify it by inspecting the file rather than running it. Bitdefender detects it as Android.Riskware.Ghostmap.rA.