diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 05ef5ed..cf9d0d3 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -243,3 +243,6 @@
     -untrusted_app_visible_halserver
   }:binder { call transfer };
 ')
+
+# Untrusted apps are not allowed to find mediaextractor update service.
+neverallow all_untrusted_apps mediaextractor_update_service:service_manager find;