diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 05ef5ed32e3991b586c72e8422e462553103fae6..cf9d0d3661ef442623f7acd95316035a11ede132 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -243,3 +243,6 @@ full_treble_only(`
     -untrusted_app_visible_halserver
   }:binder { call transfer };
 ')
+
+# Untrusted apps are not allowed to find mediaextractor update service.
+neverallow all_untrusted_apps mediaextractor_update_service:service_manager find;
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index f6889aec7b5c174a9497cc804c9c3a9cd7474283..3a906e91f89f8d9e2facccf454dbe869874ab197 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -52,6 +52,7 @@
     lowpan_device
     lowpan_prop
     lowpan_service
+    mediaextractor_update_service
     mediaprovider_tmpfs
     netd_stable_secret_prop
     network_watchlist_data_file
diff --git a/private/service_contexts b/private/service_contexts
index c1ea51a925829fd7394f0ddaf0678f867f43a287..373c7cca0a8422dd414331ac64fedc535b00e0c1 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -88,6 +88,7 @@ media.log                                 u:object_r:audioserver_service:s0
 media.player                              u:object_r:mediaserver_service:s0
 media.metrics                             u:object_r:mediametrics_service:s0
 media.extractor                           u:object_r:mediaextractor_service:s0
+media.extractor.update                    u:object_r:mediaextractor_update_service:s0
 media.codec                               u:object_r:mediacodec_service:s0
 media.resource_manager                    u:object_r:mediaserver_service:s0
 media.sound_trigger_hw                    u:object_r:audioserver_service:s0
diff --git a/private/system_server.te b/private/system_server.te
index 035e8f158a79f3fde715a87a544307640acbe0ba..6ebcab5e1acff4323e40fef554c542af35d2239a 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -746,6 +746,11 @@ allow system_server netd:bpf { map_read map_write };
 allow system_server user_profile_data_file:dir { search };
 allow system_server user_profile_data_file:file { getattr open read };
 
+userdebug_or_eng(`
+  # Allow system server to notify mediaextractor of the plugin update.
+  allow system_server mediaextractor_update_service:service_manager find;
+')
+
 ###
 ### Neverallow rules
 ###
diff --git a/public/domain.te b/public/domain.te
index 6a3d270ebb71debf22c6c6fb743aa2e0e1247071..5879e26bb8118eb424ceb454c3a8595a7e023475 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -416,6 +416,7 @@ neverallow {
     userdebug_or_eng(`-su')
     -webview_zygote
     -zygote
+    userdebug_or_eng(`-mediaextractor')
 } {
     file_type
     -system_file
diff --git a/public/mediaextractor.te b/public/mediaextractor.te
index f8e8a6b39ffd3002a89fa7e08d16c1e57868beb5..44387fd475330e02451f44f6452006ac2797ee62 100644
--- a/public/mediaextractor.te
+++ b/public/mediaextractor.te
@@ -34,6 +34,18 @@ allow mediaextractor apk_data_file:file { read getattr };
 allow mediaextractor asec_apk_file:file { read getattr };
 allow mediaextractor ringtone_file:file { read getattr };
 
+# scan extractor library directory to dynamically load extractors
+allow mediaextractor system_file:dir { read open };
+
+userdebug_or_eng(`
+  # Allow extractor to add update service.
+  add_service(mediaextractor, mediaextractor_update_service)
+
+  # Allow extractor to load media extractor plugins from update apk.
+  allow mediaextractor apk_data_file:dir search;
+  allow mediaextractor apk_data_file:file { execute open };
+')
+
 ###
 ### neverallow rules
 ###
@@ -60,4 +72,5 @@ neverallow mediaextractor domain:{ tcp_socket udp_socket rawip_socket } *;
 neverallow mediaextractor {
   data_file_type
   -zoneinfo_data_file # time zone data from /data/misc/zoneinfo
+  userdebug_or_eng(`-apk_data_file') # for loading media extractor plugins
 }:file open;
diff --git a/public/service.te b/public/service.te
index 44c3ef6ca01db7c1004db5363528f9893e3617e1..6f9d47c2b6188319fe6f61ce06773af7f9fecd47 100644
--- a/public/service.te
+++ b/public/service.te
@@ -16,6 +16,7 @@ type keystore_service,          service_manager_type;
 type mediaserver_service,       service_manager_type;
 type mediametrics_service,      service_manager_type;
 type mediaextractor_service,    service_manager_type;
+type mediaextractor_update_service, service_manager_type;
 type mediacodec_service,        service_manager_type;
 type mediadrmserver_service,    service_manager_type;
 type netd_service,              service_manager_type;