A security researcher has disclosed a pair of unpatched vulnerabilities affecting OnePlus devices that can allow a malicious Android application to obtain full root privileges without requesting any special permissions from the user. By chaining two flaws found in OnePlus software components, researcher Rasmus Moorats demonstrated how an ordinary app installed on a fully updated OnePlus smartphone could achieve the highest level of control over the device.
According to Moorats, the vulnerabilities were successfully exploited on a OnePlus 15 running the latest version of OxygenOS. OnePlus later acknowledged that the same issues potentially affect a broader range of devices from both OnePlus and OPPO, although the company has not publicly identified the affected models.
The researcher reported the vulnerabilities to OnePlus in April 2026, and the company confirmed both findings in May. However, despite acknowledging the flaws, OnePlus had not released a security patch by the time Moorats publicly disclosed the technical details on September 24. The disclosure followed months of communication during which the researcher sought updates regarding remediation efforts.
Dispute Over Vulnerability Disclosure
The case has also attracted attention because of OnePlus's response to the reporting process. In communications later published by Moorats, the company stated that it retained exclusive authority over when and how vulnerability information could be disclosed publicly.
OnePlus informed the researcher that publishing details without the company's approval could potentially expose him to legal consequences under applicable laws. The vendor further argued that while cybersecurity regulations may require vendors to receive and address vulnerability reports, they do not automatically grant researchers the right to independently publish technical details.
Despite those warnings, Moorats proceeded with disclosure after the agreed reporting period elapsed and no security update had been released.
How the Exploit Chain Works
The attack relies on two separate vulnerabilities embedded within OnePlus system components.
The first flaw resides in AtlasService, a privileged system service responsible for collecting debugging information. Running with root privileges, the service reportedly accepts requests from any installed application without properly verifying the caller's identity.
By submitting carefully crafted input, an attacker can force a bundled OnePlus debugging utility to insert user-controlled content directly into a system command. This results in command execution with root privileges, although initially within the limited confines of Android's dumpstate environment.
While this partially elevated access does not provide unrestricted device control, it creates the foothold needed for the second stage of the attack.
The follow-on vulnerability exists in another OnePlus component known as olc2, a hardware-related helper service. Researchers found that the service contains functionality capable of executing arbitrary shell commands, provided the calling process already possesses root privileges.
Once the first vulnerability grants root-level access, the second flaw can be leveraged to execute commands in a far less restricted environment. This allows an attacker to obtain full Linux-level administrative capabilities, including privileges that can affect the operating system kernel and critical system components.
Together, the two vulnerabilities effectively provide complete system-level control over the targeted device.
Impact on Users
The attack is classified as a local privilege escalation vulnerability, meaning an attacker must first convince a victim to install a malicious application.
However, the risk remains significant because the malicious app reportedly requires no dangerous permissions and presents no security prompts to the user during exploitation. Once executed, the application can silently elevate privileges and gain root access on an otherwise unmodified device.
Researchers stressed that the attack cannot be triggered remotely over the internet and that there is currently no evidence indicating active exploitation in the wild.
Moorats also verified the technique on an older OnePlus 12 Pro and believes the issue may affect a broader range of OxygenOS 16-based devices due to shared software components used across OnePlus and OPPO smartphone platforms.
No Patch Available Yet
At the time of disclosure, OnePlus had not assigned CVE identifiers to either vulnerability and had not published a security advisory addressing the issues. No official patches were available, leaving affected users without a direct mitigation.
Until updates are released, the most effective defense remains avoiding the installation of applications from untrusted or unofficial sources. Because exploitation requires a malicious application to already be present on the device, reducing app-installation risk significantly lowers exposure.
Vulnerability Timeline
- April 18, 2026: Vulnerabilities reported to OnePlus.
- May 20, 2026: OnePlus confirms both flaws and warns against unauthorized disclosure.
- June 22, 2026: Company provides an update on remediation efforts and asks for additional disclosure delay.
- July 20 & September 11, 2026: Researcher requests further updates but receives no response.
- September 24, 2026: Public disclosure released after no fixes become available.
Part of a Broader Trend
The findings are not isolated within the Android ecosystem. In August 2026, security researcher Lukas Maar disclosed a separate privilege-escalation technique capable of granting root access on fully locked flagship devices from Samsung, Xiaomi, OPPO, OnePlus, and Realme by targeting vendor-added Android components.
OnePlus has also faced criticism in previous vulnerability disclosures. In 2025, researchers from Rapid7 reported an OxygenOS flaw that allowed applications to access users' SMS messages, alleging that the company did not respond until the issue became public.
The latest disclosure highlights the security risks associated with manufacturer-added Android components and underscores the importance of timely patch deployment, coordinated disclosure practices, and rigorous security reviews of privileged system services.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
