Android flaw lets a harmless-looking app boot-loop phones
Bitdefender says a crafted Android app needing no permissions can trap a phone in an endless reboot cycle, and Google has so far not issued a fix.
The facts
- According to BleepingComputer, Bitdefender found a flaw called GhostMap that lets an app with no permissions and no executable code force an Android phone into a continuous boot loop once it is installed.
- The bug comes from two Android libraries reading ZIP compression methods differently, so a malformed APK can be mapped past its real contents and crash whichever process reads it.
- In tests on a Pixel 10 running Android 17 with the August 5 patch, the crashes began about one second after install and also blocked Safe Mode. Recovery needs a factory reset, which erases local data, or deleting the file through ADB.
- Bitdefender says it reported the issue to Google on August 20 and got a "Won't Fix (Not Reproducible)" reply. An extended report on August 25 was also ruled out of scope for a security update, though Google reserved it for a future one. Google had not replied to BleepingComputer at the time of writing.
Case notes · Danny's take
Why it matters
This attack does not steal anything. It locks you out of your own phone. No permissions, no launch, just an install. If the phone holds your banking app, your mobile money and your two-factor codes, a boot loop is a serious problem. And the only clean fix wipes your data. Google's "not reproducible" label is the part to watch: Bitdefender and Google disagree on whether this is a real flaw.
For traders
If you keep exchange apps or wallet access on one Android phone, this is a reminder that a dead phone is a risk too. Check that your seed phrase backups and 2FA recovery codes live somewhere other than that device.
For builders
Teams that ship Android apps or run device fleets should watch whether Google changes its position or issues a patch. Until then, install-time checks and tight control over app sources are the only real defence, since security tools can warn but not block installs, according to Bitdefender.
Not financial advice. Do your own investigation.
This story was summarised with AI from BleepingComputer's reporting and checked against our editorial policy. Danny's take reflects his views. Disclaimer.
Danny Walter
Founder of Moon Republic, Volt Terminal and Moon Republic Academy. Author of The Market Is a Crime Scene and After the Applause.