diff --git a/private/compat/26.0/26.0.cil b/private/compat/26.0/26.0.cil
index 2370dc10c64b81f2445bc007381a41a08498ff8f..dcb3216f73c2d5ab9b6ccba9836212674e97c692 100644
--- a/private/compat/26.0/26.0.cil
+++ b/private/compat/26.0/26.0.cil
@@ -487,7 +487,9 @@
 (typeattributeset proc_meminfo_26_0 (proc_meminfo))
 (typeattributeset proc_misc_26_0 (proc_misc))
 (typeattributeset proc_modules_26_0 (proc_modules))
-(typeattributeset proc_net_26_0 (proc_net))
+(typeattributeset proc_net_26_0
+  ( proc_net
+    proc_qtaguid_stat))
 (typeattributeset proc_overcommit_memory_26_0 (proc_overcommit_memory))
 (typeattributeset proc_perf_26_0 (proc_perf))
 (typeattributeset proc_security_26_0 (proc_security))
diff --git a/private/genfs_contexts b/private/genfs_contexts
index 29bd0c46eb64efdb57928ad02d56271955d04c2f..d05d3869070a5274045a9271a492adb416442713 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -17,6 +17,7 @@ genfscon proc /modules u:object_r:proc_modules:s0
 genfscon proc /mounts u:object_r:proc_mounts:s0
 genfscon proc /net u:object_r:proc_net:s0
 genfscon proc /net/xt_qtaguid/ctrl u:object_r:qtaguid_proc:s0
+genfscon proc /net/xt_qtaguid/ u:object_r:proc_qtaguid_stat:s0
 genfscon proc /cpuinfo u:object_r:proc_cpuinfo:s0
 genfscon proc /pagetypeinfo u:object_r:proc_pagetypeinfo:s0
 genfscon proc /softirqs u:object_r:proc_timer:s0
diff --git a/private/system_server.te b/private/system_server.te
index d9be1b22b4516b38e6b8fb5debad05c446af8897..973b017ed2f74feefd5a69c9740fd5ac66377b1a 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -702,6 +702,7 @@ allow system_server ion_device:chr_file r_file_perms;
 
 r_dir_file(system_server, proc_asound)
 r_dir_file(system_server, proc_net)
+r_dir_file(system_server, proc_qtaguid_stat)
 allow system_server {
   proc_loadavg
   proc_meminfo
diff --git a/public/app.te b/public/app.te
index 3b0495580278f6a2937a9393baf0fe6845c98ad2..582995a56f32243118ad0d9bbd78736e63a0971f 100644
--- a/public/app.te
+++ b/public/app.te
@@ -171,11 +171,13 @@ userdebug_or_eng(`
 
 # Write to /proc/net/xt_qtaguid/ctrl file.
 allow appdomain qtaguid_proc:file rw_file_perms;
-# read /proc/net/xt_qtguid/stats
-r_dir_file({ appdomain -ephemeral_app}, proc_net)
+r_dir_file({ appdomain -ephemeral_app -isolated_app }, proc_net)
+# read /proc/net/xt_qtguid/*stat* to per-app network data usage.
+# Exclude isolated app which may not use network sockets.
+r_dir_file({ appdomain -isolated_app }, proc_qtaguid_stat)
 # Everybody can read the xt_qtaguid resource tracking misc dev.
 # So allow all apps to read from /dev/xt_qtaguid.
-allow appdomain qtaguid_device:chr_file r_file_perms;
+allow { appdomain -isolated_app } qtaguid_device:chr_file r_file_perms;
 
 # Grant GPU access to all processes started by Zygote.
 # They need that to render the standard UI.
diff --git a/public/file.te b/public/file.te
index e8e87b88def1c8811e220853454a256f7fc8aa86..9d74f85ccfacf6081a4741c3d5c67ee8abca7d7d 100644
--- a/public/file.te
+++ b/public/file.te
@@ -12,6 +12,7 @@ type proc_overcommit_memory, fs_type;
 type usermodehelper, fs_type;
 type sysfs_usermodehelper, fs_type, sysfs_type;
 type qtaguid_proc, fs_type, mlstrustedobject;
+type proc_qtaguid_stat, fs_type, mlstrustedobject;
 type proc_bluetooth_writable, fs_type;
 type proc_abi, fs_type;
 type proc_asound, fs_type;