Google reopens GhostMap Android flaw discovered by Bitdefender; raises severity to High

Google has reopened its investigation into GhostMap, the Android vulnerability discovered by Bitdefender Labs, and raised the severity to High following a closer review, according to Google’s update to Bitdefender’s report.

In Bitdefender’s testing, the flaw left a phone stuck in a crash loop after a specially crafted app was installed, which may force users to factory-reset the device and lose locally stored data.

The reassessment changes Google’s earlier position. When Bitdefender published its findings on Nov. 5, Google had classified the expanded report as outside the scope of a security update fix. The company has now reopened the issue, although the update doesn’t include confirmation of a patch or a release date.

Key takeaways

• Google has reopened the GhostMap issue and elevated the vulnerability’s severity to High.
• Installing a specially crafted app can trigger repeated crashes, even if the user never opens it or grants it any permissions.
• Bitdefender testing showed that restarts and safe mode didn’t resolve the crash loop. Recovery may require a factory reset that erases locally stored data.
• The revised assessment doesn’t, by itself, mean a fix is available.

What changed in Google’s assessment?

Google’s revised assessment follows two reports Bitdefender submitted through the Android & Devices Vulnerability Reward Program in August 2026.

The first submission, sent Aug. 20, documented crashes during installation and when applications inspected a malformed Android app file. Google closed it as “Won’t Fix (Not Reproducible)” and described it as outside the program’s scope.

Bitdefender researchers continued investigating and submitted expanded findings on Aug. 25, including a working demonstration of a persistent system crash loop and instructions for reproducing it. Google initially considered those findings outside the scope of a security update fix and referred them for possible consideration in a future Android version.

Following a closer investigation, Google has now reopened the issue and elevated its severity to High, according to Google’s update in the reward program.

For consumers, the practical concern remains the recovery process: getting a phone working again may require erasing files that haven’t been backed up.

How can an app you don’t even open crash your phone?

GhostMap involves how Android reads information inside an app’s installation file, known as an APK.

Two Android components interpret part of that file differently. A specially crafted file can exploit that disagreement, forcing Android to try to read beyond the file’s actual contents and crash.

Bitdefender’s demonstration app contained no executable code, requested no permissions and never needed to launch. After installation, a core Android service automatically read the malformed resource and crashed. When the service restarted, it faced the same resource and crashed again.

Researchers reproduced the persistent loop on a Pixel 10 running Android 17 with the Aug. 5, 2026 security patch, and simply restarting the phone had no effect, as the crash loop continued in safe mode. The flaw is present starting with Android 10 and upwards.

What did the initial investigation find?

The investigation began on Aug. 12 when a banking malware sample collected in the wild crashed Bitdefender’s analysis emulators during installation.

That sample caused a failed installation. Researchers then investigated the underlying Android flaw and developed a separate demonstration that produced the persistent crash loop.

Discovering the banker sample, however, doesn’t establish that attackers were deliberately using GhostMap to disable phones. At publication, Bitdefender hadn’t observed the persistent crash-loop technique being used against victims.

The Bitdefender Labs report explains the technical findings, while the follow-up consumer-oriented article describes the recovery risks.

What should Android users do?

Treat unexpected requests to install an APK with caution, especially when they arrive through messages, ads or unfamiliar websites. If an app claims to be an essential update, check through its official distribution channel.

Back up photos, documents, and other files. A backup will help if you get stuck in a crash loop and need to perform a factory reset.

Install security updates immediately as they become available. Google’s revised assessment is a development in how it's handling GhostMap, but users shouldn’t assume it means their device has received a fix.

FAQ

Has Google fixed GhostMap?

The new information confirms that Google reopened the issue and raised its severity to High. It doesn’t confirm a patch or release date.

Can GhostMap steal my photos or messages?

The demonstrated flaw causes repeated crashes. It doesn’t itself give an attacker access to your files or accounts. The data-loss risk comes from a necessary factory reset.

Will restarting an affected phone help?

Restarting and safe mode didn’t stop the persistent crash loop in Bitdefender’s testing. Recovery may require a factory reset.

Android, Google and Pixel are trademarks of Google LLC. This article reflects Bitdefender’s research and information available at the time of publication.