A newly discovered GhostMap, an Android parser-differential defect, allows a crafted APK without executable code or permissions to cause a persistent system_server crash loop on a device running Android 17, including versions as recent as Android 10 This article explores discovered ghostmap android. . Researchers, led by Alecsandru Cătălin Daj, successfully reproduced the fault on a Pixel 10 with the August 5, 2026 security patch.
The investigation began on August 12, 2026, when a banking dropper crashed Bitdefender’s analysis emulators during installation.
The root cause of this issue stems from a disagreement between two native libraries regarding ZIP entry metadata. These entries bypass validation in one library and map at their declared size in the other, leading to an oversized mmap of the APK. Streaming reads encounter a fault in _FileAsset::read through __memcpy_aarch64_simd.
Whole-entry loads fail during the aligned copy in _FileAsset::ensureAlignment, which allocates a buffer of the declared length and calls memcpy on it.
ADB deletion is effective only if USB debugging was already enabled, and only before the first full kernel reboot. Malware can thwart uninstallation due to a malformed icon, which causes the launcher and Settings to crash when they attempt to draw it. Since Android doesn't allow third-party apps to block installations, users must respond to the warning.
Join 16,000+ SOC teams using ANY.RUN to enhance threat investigations and minimize manual workload.
