Bitdefender researchers disclosed an Android flaw they call GhostMap that lets an installed app force the device into a persistent boot loop. The app needs no permissions, contains no executable code and does not even have to be opened: a core system process reads one of its files automatically after installation, crashes, restarts and crashes again.
The cause lies in two Android libraries that interpret ZIP compression methods differently, letting a malformed APK bypass size checks. In tests on a Pixel 10 running Android 17 with the August 5 security patch, the loop began about a second after installation and continued in Safe Mode as well.
The only ways out are a factory reset, which erases local data, or deleting the file over ADB, which requires debugging to have been enabled already. Bitdefender reported the issue to Google on August 20 and was told it was "not reproducible"; Google considered it for a future update, but not as a security fix.
Until there is a fix, the advice is to install apps only from trusted sources. BleepingComputer asked Google when a fix will ship and has not yet received a reply.