Currently, no. If he wanted to, he might try and might even be successful.

He'd have to write a malicious update and you'd have to install the update.