An Android app with no code or permissions can trap phones in a boot loop
Comments on “An Android app with no code or permissions can trap phones in a boot loop”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Bitdefender Labs reports "GhostMap," an Android flaw in which an app with no code or permissions, never opened, can send system_server into a boot loop that safe mode doesn't stop. The cause is a mismatch between libziparchive and libandroidfw in handling ZIP entries with unusual compression methods. Bitdefender reproduced it on a Pixel 10 with Android 17 and says it affects Android 10 and later. Google said it won't fix it through a security update. Bitdefender has seen no exploitation, and the claims come from its own testing.
Why it ranked
No. 2 of 107 with a score of 0.74. The panel rated it highest on technical depth (0.95) and new information (0.93), lowest on audience breadth (0.73).
- AI judgeJudge 2claude-haiku-5-5
- Detailed, well-evidenced Android parser bug with a reproducible crash-loop technique and a disclosure timeline; significant security finding for builders, though vendor-facing and partly speculative in attack scenarios.
- AI judgeJudge 3gpt-5.6-luna
- Detailed reproducible Android denial-of-service research with source-level analysis, crash traces, affected versions, and mitigations. It is highly relevant to security practitioners, though attack scenarios remain hypothetical and vendor detection introduces modest promotional bias.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.74total under rubric v2.3
- Significance0.74
- Reader interest0.85
- Audience breadth0.73
- Practical relevance0.73
- Substantiated0.91
- Technical depth0.95
- New information0.93
- Counts against: Promotional0.14
- Counts against: Overclaim0.27
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.67 | 0.72 | 0.82 | 0.74 | 0.15 | +0.24 | +0.177 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.73 | 0.90 | 0.93 | 0.85 | 0.20 | +0.26 | +0.222 |
| Audience breadthHow many people who build technology does it concern? | 0.66 | 0.80 | 0.72 | 0.73 | 0.14 | +0.13 | +0.095 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.71 | 0.70 | 0.79 | 0.73 | 0.09 | +0.22 | +0.162 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.97 | 0.85 | 0.92 | 0.91 | 0.12 | +0.05 | +0.046 |
| Technical depthHow technically substantive is it? | 1.00 | 0.90 | 0.96 | 0.95 | 0.10 | +0.05 | +0.048 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.90 | 0.90 | 0.98 | 0.93 | 0.08 | +0.05 | +0.046 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.20 | 0.18 | 0.14 | 0.15 | −0.19 | −0.027 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.25 | 0.35 | 0.20 | 0.27 | 0.15 | −0.11 | −0.029 |
| Sum of contributions | +0.738 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.738 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-07/2/"><img src="https://rubric.hrih.si/badge/2026-11-07/2.svg" alt="Ranked #2 on Rubric, 7 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 5 no source given · 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenVersion
Bitdefender reproduced the crash loop on a Pixel 10 running Android 17 with the Aug. 5, 2026 security patch, and says it affects Android 10 and above.
The article gives no link or citation for it.
The article says “Researchers reproduced the failure on a Pixel 10 running Android 17 with the Aug. 5, 2026 security patch. It affects all Android versions from Android 10 and above”
The source says No source to compare with.
No source givenQuote
Google closed Bitdefender's first report as Won't Fix (Not Reproducible) and, after the second report, said the issue was outside the scope of a security update fix and forwarded it to a feature team.
The article gives no link or citation for it.
The article says “Google responded shortly afterwards, stating that it considered the issue outside the scope of a security update fix”
The source says No source to compare with.
No source givenCausal conclusion
The Android bug stems from libziparchive checking uncompressed size only for stored entries while libandroidfw maps every non-deflated entry at its declared uncompressed size, so entries with other method values go unchecked.
The article gives no link or citation for it.
The article says “An entry marked with some other method — neither stored nor deflated — falls into the gap between those two rules”
The source says No source to compare with.
No source givenNumber
In the Bitdefender tombstone, an 8,408-byte APK was mapped across about 16 MB, and the crash loop repeated 110 times in one capture.
The article gives no link or citation for it.
The article says “In one capture, the cycle then repeated 110 times”
The source says No source to compare with.
No source givenDate
Google patched a weaker version of this defect in the November 2016 bulletin (CVE-2016-6724), rated Moderate and fixed across Android 4.4.4 to 7.0.
The article gives no link or citation for it.
The article says “Rated Moderate, fixed across Android 4.4.4 to 7.0”
The source says No source to compare with.
Couldn’t checkNumber
Palo Alto's Unit 42 found about 9,200 BadPack samples in a single year, used by banking trojans including Anatsa, Cerberus and BianLian.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Palo Alto's Unit 42 found about 9,200 such samples in a single year, used by banking trojans including Anatsa, Cerberus and BianLian”
The source says No passage could be compared.
Source cited by the article: unit42.paloaltonetworks.com/apk-badpack-malware-tampered-headers
Couldn’t checkNumber
The Janus vulnerability (2017, CVE-2017-13156) let a single file be both a valid APK and a valid DEX, because the signature check ignored extra bytes at the front of the file.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “A single file could be a valid APK and a valid DEX at the same time”
The source says No passage could be compared.
Source cited by the article: nvd.nist.gov/vuln/detail/CVE-2017-13156
Couldn’t checkNumber
Master Key (2013, CVE-2013-4787) involved an APK with two same-named files, where Android checked the signature on the first and installed the second.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “An APK contained two files with the same name. Android checked the signature on the first and installed the second”
The source says No passage could be compared.
Source cited by the article: nvd.nist.gov/vuln/detail/CVE-2013-4787
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 3 pts, not on front page
Recorded for context only, checked 7 Nov 2026, 05:47 UTC. It played no part in the ranking.