An Android app that never runs can trap a phone in a crash loop, and there's no fix yet

Bitdefender's researchers were studying a banking-malware dropper that kept crashing their test phones before it ever did anything. The reason turned out to be more interesting than the malware. The app's package was built so that Android misreads one of the files inside it, and whichever part of the system touches that file falls over. They called it GhostMap and published the details on 5 November.

What's unsettling is how little the app needs. It contains no code that runs, asks for no permissions and never has to be opened. Bitdefender built a test app with a resource that system_server, the heart of Android, reads automatically after installation. About a second after install, the phone crashed, restarted and crashed again: 110 times in a normal boot, 72 times in safe mode. The test phone was a Pixel 10 on Android 17 with the 5 August security patch, and Bitdefender says every version from Android 10 up is affected. Getting out means a factory reset, unless USB debugging happened to be switched on beforehand.

Google closed the first report in August as "Won't Fix (Not Reproducible)". After a second report it called the problem outside the scope of a security update and passed it on for a possible future Android version. Bitdefender says it hasn't seen the crash-loop trick used against anyone, so nobody needs to panic. The sensible response is the old one. Install apps from Google Play, be suspicious of any message that wants you to install an APK to see a parcel update or open a document, and check your photos are actually backing up somewhere other than the phone. A reset is only a disaster when it wipes the only copy.

That last point applies to your PC just as much, and Tendvane's one-click Backup copies your Documents, Pictures and Desktop so a bad day doesn't take them with it.