Local privilege escalation via malicious config update

Privilege escalation in Android 11 through 14 allows local users to gain elevated access by triggering a malicious configuration update. The startInstall method in UpdateFetcher.java accepts the malicious update because an undisclosed logic error defeats its protection mechanism. Exploitation requires local execution but no additional execution privileges or user interaction, and Google has not published the exact erroneous condition.