GhostMap Android Flaw Can Boot-Loop Phones, No Patch

Unpatched. Bitdefender reports an Android flaw, named GhostMap, that lets an installed app force a phone into a persistent boot loop. Per BleepingComputer, Google has not shipped a fix. No CVE ID appears in the source. Exploitation in the wild is not reported.

What is reported

• The reported impact is denial of service. The app needs no permissions and does not need to be launched. Installation alone is enough, per Bitdefender.
• The bug class is a file-handling inconsistency between two Android components. The source does not support more detail here, and this article leaves further mechanics to Bitdefender’s report.
• Bitdefender says it found the flaw while analyzing an Android banking trojan that kept crashing its emulators. Whether any malware uses GhostMap deliberately is unconfirmed.

Test conditions

The reported test device was a Pixel 10 on Android 17 with the August 5 security patch. Other devices and patch levels were not described in the source. Affected range: unconfirmed.

Google’s response

Bitdefender says it reported the issue on August 20 and received “Won’t Fix (Not Reproducible).” It says an extended report on August 25 was also judged out of scope for a security update, though Google reserved it for a future release. BleepingComputer asked Google about fix status and had no reply at publication.

Recovery

Bitdefender says Safe Mode does not break the loop. Two recovery paths are reported: a factory reset, which erases local data, or removing the offending file over ADB (Android Debug Bridge). ADB only works if debugging was already enabled on the device.

Bitdefender says the only real chance to stop the attack is at install time. Third-party security tools may warn, but cannot block installation. Confidence: moderate. This is one vendor’s research with a partial vendor response on record.

For context on this month’s Android fixes, see the November bulletin coverage and the SMS of Death report. Neither covers GhostMap.