Unpatched OnePlus Flaws Grant Root Access to Installed Android Apps
Two vulnerabilities in OnePlus's OxygenOS allow any installed Android application to gain root access without requiring special permissions, potentially compromising user devices.
Two critical vulnerabilities discovered in OnePlus's OxygenOS software allow any malicious Android application already installed on a device to escalate its privileges to root access, the highest level of control over a smartphone. Researcher Rasmus Moorats successfully chained these two flaws, which affect a range of OnePlus and OPPO devices, to demonstrate full device compromise. This discovery raises significant concerns about the security of user data and device integrity on affected models.
The first vulnerability resides within a OnePlus service called AtlasService, which is designed to gather debugging data and operates with root privileges. Crucially, this service accepts calls from any application without performing adequate authentication, allowing a malicious app to send crafted requests. These requests can target a OnePlus debugging tool that processes text input from the app and inserts it, unchecked, into a system command. This initial step grants the attacker root privileges, but within a restricted environment known as dumpstate, limiting its capabilities.
The second vulnerability is necessary to achieve full root access. It lies within another OnePlus service, olc2, a hardware helper component. This service includes a command that executes any shell instruction it receives, but it normally requires the caller to already possess root privileges. By chaining the first vulnerability to gain the necessary root access within the dumpstate zone, an attacker can then leverage olc2. The olc2 command executes in a more permissive environment, granting the attacker low-level Linux privileges, including the ability to load kernel code, thereby achieving complete system-level control over the device.
This attack vector requires the malicious application to be already present on the device, meaning it cannot be exploited remotely over the internet. However, once installed, the app requires no special permissions from the user and provides no visible prompts, making it stealthy. Moorats confirmed the exploit works on a stock OnePlus 15 and also demonstrated its effectiveness on an older OnePlus 12 Pro. He anticipates that the vulnerability affects OxygenOS 16 broadly, and due to shared software architecture, it likely impacts OPPO devices as well.
OnePlus acknowledged the existence of both flaws in May 2026. However, as of the researcher's public disclosure on September 24, 2026, no patch had been released, and no CVE identifiers had been assigned. The company's response to Moorats indicated a scheduled fix but also asserted "the exclusive final right of vulnerability disclosure," warning that publishing technical details without consent could lead to legal repercussions. This stance highlights a growing tension between security researchers and device manufacturers regarding disclosure timelines and control.
Given the lack of a patch, the primary mitigation advised by Moorats is to exercise caution when installing applications. Users should only download apps from trusted sources, as the attack chain requires a malicious app to be present on the device. This underscores the importance of robust app vetting and user awareness in the face of sophisticated mobile threats.
This incident is not isolated. In August 2026, researcher Lukas Maar demonstrated a similar technique affecting multiple flagship Android brands, including Samsung, Xiaomi, OPPO, OnePlus, and Realme, by exploiting custom code added by manufacturers. Furthermore, OnePlus has faced criticism for slow responses to security researchers in the past, including a 2025 incident involving a critical OxygenOS flaw that allowed unauthorized access to user text messages.
The disclosure timeline provided by Moorats reveals a protracted engagement with OnePlus, spanning approximately five months from initial reporting to public disclosure, with the company repeatedly delaying fixes and asserting control over the disclosure process.