By using the system helpers unprivileged RemoveLocalRef method, an attacker was able to remove the remote ref of the app or runtime. The anti-downgrade check would fail to find the remote ref, and with it the date to check against. This allows an attacker to bypass the check and downgrade apps.