GHOSTMAP: THE ANDROID FLAW THAT CRASHES YOUR PHONE BEFORE YOU OPEN THE APP

Summary from the TLDR InfoSec newsletter

An APK entry using a nonstandard compression method slips past libziparchive's size check, while libandroidfw memory-maps it at its full declared size. As a result, any process that reads a malformed resource receives a SIGBUS. That flaw lets an app with no code or permissions trap system_server in a boot loop that only a factory reset clears, or cause its own icon to crash on every uninstall screen. Bitdefender found it when a packed banking dropper in the wild crashed its emulators, but the persistent boot loop was its own escalation. Google declined to ship a security fix even though the bug reproduces on Android 10 through 17. With no patch coming, defenders should flag APKs whose ZIP entries use compression methods other than stored or deflate before they're installed, since an on-device warning may come too late.