Local privilege escalation via writable application packages

Improper privilege management in Android 11 System allows local users with System privileges to execute code in other processes. The system_app SELinux policy grants adb data-loader code write access to apk_data_file objects and read access to incremental-control files, allowing an installed application's base.apk to be overwritten. Exploitation requires existing System execution privileges and no user interaction; the resulting code runs in another process's security context.