CVE-2026-46331 AppArmor Bypass via aa-exec Profile Switching on Ubuntu 24.04

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

Detects the execution of the 'aa-exec' process with specific command-line arguments ('trinity', 'chrome', or 'flatpak') that are often associated with malicious tools, persistence, or bypass techniques.