Information

LG World (com.lge.lgworld) built-in app downloads self-updating APK file to the public accessible storage and does not verify a signature. An attacker can overwrite the file and install an arbitrary app.

LG Vulnerability ID: LVE-SMP-170026



References:
https://research.checkpoint.com/androids-man-in-the-disk/