Bitdefender disclosed GhostMap on November 5, describing an Android parsing flaw that can cause a persistent crash loop after installation of a specially crafted application. Its demonstration needed no executable application code, permission grant or user launch.
The investigation began with a banking-dropper package that crashed analysis emulators during installation. Bitdefender says the persistent system-crash demonstration was its own subsequent work, and it has not observed that attack being used against people. Discovery in a malicious sample is therefore distinct from evidence of deliberate exploitation of the demonstrated capability.
The researchers attribute the flaw to inconsistent handling of package compression and size information. Their documented device test used a Pixel 10 running Android 17 with the August 5 security patch; they also report reproduction on older releases.
According to Bitdefender, Google treated its August submissions as outside the scope of a security-update fix. The researchers report no available fix at disclosure. Their demonstrated recovery could require a factory reset; a limited debugging-based recovery depended on prior device configuration.
NAOAT analysis
The finding changes where the failure begins. An application can create operational harm through data processed by the operating system, before the application itself takes an action. That makes a permission prompt an incomplete description of installation risk and ties availability to the behavior of shared parsing components.
For organizations relying on mobile devices for field work, the practical exposure includes interruption and recovery effort, not only information theft. This report does not establish a theft capability or an active campaign. Its value is a concrete demonstration of how a malformed package can cross from a failed installation into a repeated system failure, with ordinary restart assumptions no longer sufficient.