> Bitdefender reported the issue to Google on August 20, but received a “Won’t Fix (Not Reproducible)” reply, with the issue being out of scope.
> The researchers submitted an extended version on August 25, believing Google misclassified the original report. The tech giant still deemed it out of scope for a security update, though it reserved it for consideration in a future update.
Recently, there was a report of a different Android vulnerability that Google claimed it would not fix. The vulnerability is called SMS of Death and Google actually wound up quietly fixing it without notifying anyone. I wonder if that is the case with GhostMap here.
> Blaszczyk first alerted Google on May 5, but says Google repeatedly dismissed his report as a non-security issue. Frustrated by the response, he publicly disclosed the vulnerability and released a working demonstration on October 29. Except Google had already been working on a solution.
> [...] Google reportedly patched the vulnerability in its October 2026 Android security updates for Android 14 through 17. However, the flaw is not listed in Google's October security bulletin [...]
I wonder if Google chooses to behave this way to try to keep things on the down-low, so as not to scare the average user.
> Bitdefender reported the issue to Google on August 20, but received a “Won’t Fix (Not Reproducible)” reply, with the issue being out of scope.
> The researchers submitted an extended version on August 25, believing Google misclassified the original report. The tech giant still deemed it out of scope for a security update, though it reserved it for consideration in a future update.
Recently, there was a report of a different Android vulnerability that Google claimed it would not fix. The vulnerability is called SMS of Death and Google actually wound up quietly fixing it without notifying anyone. I wonder if that is the case with GhostMap here.
More about SMS of Death: https://www.androidauthority.com/android-sms-of-death-google...
> Blaszczyk first alerted Google on May 5, but says Google repeatedly dismissed his report as a non-security issue. Frustrated by the response, he publicly disclosed the vulnerability and released a working demonstration on October 29. Except Google had already been working on a solution.
Also: https://www.bleepingcomputer.com/news/security/new-android-s...
> [...] Google reportedly patched the vulnerability in its October 2026 Android security updates for Android 14 through 17. However, the flaw is not listed in Google's October security bulletin [...]
I wonder if Google chooses to behave this way to try to keep things on the down-low, so as not to scare the average user.