Android bug can trap phones in crash loop, Bitdefender warns

Bitdefender has disclosed an Android flaw that can leave a phone stuck in a crash loop after a specially crafted app is installed. The issue affects devices running Android 10 and later.

According to the security firm, the app does not need to be opened, request permissions or contain executable code. In testing, the problem persisted after reboot and continued in safe mode, leaving a factory reset as the main recovery option in most cases.

Researchers first identified the issue after an APK collected in the wild crashed emulators during installation. The sample was described as a banking dropper wrapped with a packer that altered the APK's internal structure. That investigation led them to what they described as a deeper problem in Android's handling of ZIP entry data inside APK files.

Bitdefender said Android mishandles two fields in a ZIP entry: the compression method and the declared uncompressed length. When those fields are malformed in a particular way, a process reading the file can trigger a SIGBUS fault and crash.

The problem can affect different parts of the operating system depending on which file in the APK is malformed and which Android component reads it. If the malformed file is parsed during installation, the installer crashes and the app fails to install. If a core system service reads the malformed file after installation, the crash can occur inside system_server, the central Android process that hosts many system services.

That distinction is central to the severity described by the researchers. A failed installation leaves no lasting effect beyond the crash itself. But if installation succeeds and system_server repeatedly crashes, the device may be unable to complete startup, creating a continuous reboot cycle.

Bitdefender said it reproduced the issue on a Pixel 10 running Android 17 with the August security patch, and found the same behaviour on versions dating back to Android 10. The screen remained on the boot animation while the cycle repeated, and safe mode did not interrupt the process because the affected service read the malformed file before safe mode took effect.

Google response

The researchers said they reported the issue twice through Google's Android & Devices Vulnerability Reward Program. According to Bitdefender, Google closed the first report as not reproducible and outside the programme's scope.

A later report included a proof of concept and reproduction instructions for a persistent system crash loop. Bitdefender said Google responded that the issue was outside the scope of a security update fix and had been referred to a relevant team for possible consideration in a future version update.

The company argued that the bug presents a significant denial-of-service risk because it can make a device unusable without code execution or elevated permissions. It added that it had not observed the persistent crash-loop technique being used against victims in the wild.

Attack paths

The findings outline several theoretical abuse scenarios. One would involve disguising the malformed file in a fake app to disable a victim's handset and force a choice between data loss through a factory reset and an unusable device. Another would involve an app that remains operational while its malformed icon crashes the launcher and settings interfaces used for removal, making uninstallation difficult.

The same parsing behaviour could also affect security products and analysis tools that inspect Android applications. Bitdefender said any app or service using Android's native APIs to parse a malformed APK could crash, including scanning tools that rely on standard package inspection calls.

The underlying issue, the researchers said, belongs to a long-running class of parser differential problems in Android, where different parts of the operating system interpret the same APK structure in different ways. They linked the newly described behaviour to earlier Android flaws such as Master Key and Janus, as well as more recent APK tampering techniques used by malware authors to interfere with analysis tools.

Bitdefender said the bug does not allow code execution, data theft or privilege escalation. Its impact is limited to denial of service, but the effect can still be severe because the crash loop can leave the phone inaccessible and force the user to erase locally stored data.

With no fix currently available, prevention depends largely on identifying a crafted file before Android reads it in the vulnerable way. Bitdefender added that, in limited cases where USB debugging had already been enabled, a user could try to remove the file through Android Debug Bridge before the system crashed again, though even that option could disappear after a full reboot.

Bitdefender said its own mobile security product detects the malformed files as Android.Riskware.Ghostmap.rA and can warn users when such an app reaches the device, whether as a download or an installed file. It added, however, that Android does not allow a third-party app to block an installation or directly remove another app, leaving the response to the user.

“The app contains no code and never needs to run,” said Alecsandru Cătălin Daj, Team Lead in the Mobile Security & Forensics Unit at Bitdefender.