Unpatched OnePlus Flaws Let Malicious Apps Gain Root Access Without Permissions

Two unpatched vulnerabilities in OnePlus software can allow a malicious Android app to gain root access on affected OnePlus smartphones without requesting any special permissions.

Security researcher Rasmus Moorats chained the two flaws on a OnePlus 15 running the latest OxygenOS. Root access provides the highest level of control over an Android device.

OnePlus confirmed the vulnerabilities in May 2026 and told Moorats that the same issues affect additional OnePlus and OPPO devices, although the company has not publicly identified the affected models.

As of September 24, OnePlus had not released a fix or assigned CVEs to the vulnerabilities.

How the Attack Works

The first vulnerability affects a OnePlus service called AtlasService.

The service collects debugging information, runs with root privileges, and accepts requests from applications without properly verifying the caller.

A malicious app can send a specially crafted request to a OnePlus debugging component. The component places attacker-controlled input into a system command without proper validation.

This allows the application to execute commands with root privileges inside a restricted system environment known as dumpstate.

The first vulnerability alone does not provide unrestricted control because the dumpstate environment limits what the root process can do.

Second Vulnerability Provides Full System-Level Control

The second flaw affects another OnePlus service called olc2, a hardware-related helper service.

The service contains a command that can execute arbitrary shell instructions supplied by the caller. Its main security check is that the caller must already have root privileges.

Because the first vulnerability provides root access, the malicious application can reach this second service.

The resulting command execution occurs in an environment with broad Linux privileges, including the ability to load kernel code. This gives the malicious application much deeper control over the device.

No Special Permissions Required

The attack is local, meaning the malicious application must first be installed and running on the target device.

However, once installed, the application does not require special Android permissions or additional user interaction.

Moorats demonstrated the attack on a stock device that had not been modified or rooted.

There is currently no evidence that these vulnerabilities have been exploited in real-world attacks.

Potentially Affected Devices

Moorats confirmed the attack on a OnePlus 15 and an older OnePlus 12 Pro.

He also expects the vulnerabilities to affect a broader range of devices running OxygenOS 16.

OnePlus told the researcher that the same vulnerabilities affect additional OnePlus and OPPO devices, but the company has not publicly disclosed the complete list of affected models.

OnePlus Disclosure Dispute

Moorats reported both vulnerabilities to OnePlus on April 18, 2026.

According to the correspondence published by the researcher, OnePlus confirmed the vulnerabilities on May 20 and said a fix was planned.

The company also stated that it had the final authority over vulnerability disclosure and warned that publishing the technical details without permission could create legal liability.

Moorats agreed to delay publication until September 17 while waiting for updates.

He requested additional information from OnePlus on July 20 and September 11 but said he did not receive further responses.

He published his technical findings on September 24.

Timeline

• April 18, 2026: Vulnerabilities reported to OnePlus.
• May 20: OnePlus confirmed the vulnerabilities and said a fix was planned.
• June 22: OnePlus provided a further update and requested additional disclosure delay.
• July 20: Researcher requested an update.
• September 11: Researcher made another follow-up request.
• September 24: Technical details were publicly disclosed.

What Users Can Do

Until OnePlus releases security updates addressing the vulnerabilities, the attack still requires a malicious application to be installed on the device.

Users should therefore:

• Install applications only from trusted sources.
• Avoid installing unknown or unverified APK files.
• Keep OxygenOS and security updates up to date.
• Remove applications that were installed from untrusted sources.
• Review recently installed applications if unexpected device behavior occurs.

There is currently no evidence that simply visiting a website is enough to exploit these vulnerabilities.

Previous Android Root-Level Attacks

The disclosure follows other research showing how applications without special permissions can potentially reach privileged levels on Android devices.

In August 2026, researcher Lukas Maar demonstrated a separate technique that could reportedly take a no-permission application to root on devices from Samsung, Xiaomi, OPPO, OnePlus, and Realme by targeting manufacturer-added Android components.

A separate OxygenOS vulnerability reported in 2025 also allowed applications to access users' text messages without the required permissions.

Key Takeaway

The two OnePlus vulnerabilities demonstrate how seemingly limited privileged services can be chained to achieve complete system-level control.

Because the attack requires only that a malicious application be installed, users should avoid untrusted APKs and install OnePlus security updates as soon as fixes become available.