An Android app with no code or permissions can trap phones in a boot loop

Bitdefender Labs reports "GhostMap," an Android flaw in which an app with no code or permissions, never opened, can send system_server into a boot loop that safe mode doesn't stop. The cause is a mismatch between libziparchive and libandroidfw in handling ZIP entries with unusual compression methods. Bitdefender reproduced it on a Pixel 10 with Android 17 and says it affects Android 10 and later. Google said it won't fix it through a security update. Bitdefender has seen no exploitation, and the claims come from its own testing.