Local privilege escalation via ungrantable permission acceptance

Incorrect authorization in Android 8.0, 8.1, 9, and 10 allows local users to obtain restricted network access without interaction. PermissionMonitor.hasPermissions treats a requested privileged permission as held without checking whether the app can actually be granted it, then supplies that false authorization state to netd. Exploitation requires a locally installed low-privileged application; the resulting access bypasses restricted-network controls rather than granting unrestricted root execution.