diff --git a/libc/bionic/__bionic_get_shell_path.cpp b/libc/bionic/__bionic_get_shell_path.cpp
index 477fa4a..41162e9 100644
--- a/libc/bionic/__bionic_get_shell_path.cpp
+++ b/libc/bionic/__bionic_get_shell_path.cpp
@@ -31,18 +31,24 @@
 #include <sys/cdefs.h>
 #include <unistd.h>
 
-__LIBC_HIDDEN__ static const char* __libc_system_sh = "/system/bin/sh";
-__LIBC_HIDDEN__ static const char* __libc_vendor_sh = "/vendor/bin/sh";
+#define VENDOR_PREFIX "/vendor/"
 
 static const char* init_sh_path() {
-  /* look for /system or /vendor prefix */
-  char exe_path[7];
-  ssize_t len = readlink("/proc/self/exe", exe_path, sizeof(exe_path));
-  if (len != -1 && !strncmp(exe_path, __libc_vendor_sh, sizeof(exe_path))) {
-    return __libc_vendor_sh;
-  }
+  /* If the device is not treble enabled, return the path to the system shell.
+   * Vendor code, on non-treble enabled devices could use system() / popen()
+   * with relative paths for executables on /system. Since /system will not be
+   * in $PATH for the vendor shell, simply return the system shell.
+   */
 
-  return __libc_system_sh;
+#ifdef __ANDROID_TREBLE__
+  /* look for /system or /vendor prefix */
+  char exe_path[strlen(VENDOR_PREFIX)];
+  ssize_t len = readlink("/proc/self/exe", exe_path, sizeof(exe_path));
+  if (len != -1 && !strncmp(exe_path, VENDOR_PREFIX, strlen(VENDOR_PREFIX))) {
+    return "/vendor/bin/sh";
+  }
+#endif
+  return "/system/bin/sh";
 }
 
 __LIBC_HIDDEN__ extern "C" const char* __bionic_get_shell_path() {