Local privilege escalation via premature permission-session termination

Privilege escalation in Android 13 through 16 allows local users to bypass one-time permission limits through the Permission Controller. The AppPermissionGroup persistChanges path stops the package-wide one-time permission session when one permission is revoked, without checking whether another one-time permission remains granted. Exploitation requires user interaction and an app with multiple one-time permissions, allowing a remaining grant to outlive the session that should revoke it.