Bitdefender Labs researchers built an Android app that contains no executable code and requests no permissions, and installing it leaves a Pixel 10 in a crash loop that can take a factory reset to clear. The flaw, which Bitdefender calls GhostMap, comes from how Android reads the ZIP structure inside an APK. The app does not need to be opened.
A banking malware sample led researchers to an Android bug that can loop-crash phones
About this summary. This is a short excerpt from the description that Help Net Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.helpnetsecurity.com/2026/11/05/ghostmap-android-bug-research/
Source attribution: headline and facts are from Help Net Security (helpnetsecurity.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
GhostMap Android flaw lets malicious app trigger persistent boot loop
Attackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed.
Android security advisory – November 2026 monthly rollup (AV26-1128)
Serial number: AV26-1128 Date: Novembre 4, 2026 As of November 2, 2026, Android published a security bulletin to address vulnerabilities affecting Android devices. The…
Android’s November 2026 Updates Patch Over 200 Vulnerabilities
The most severe is a critical flaw in Framework leading to remote code execution without user interaction.
Applebee’s customer data exposed by password left in app
Applebee’s has fixed a security flaw that exposed customers’ personal information after a researcher discovered a database password embedded in the restaurant chain’s…
SMS of Death: Android under attack, an invisible SMS can block calls and emergency services
SMS of Death lets attackers crash Android call services with a hidden, zero-click message, blocking phone calls, even emergency calls too. A specially manipulated SMS…
Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec. The…