Unpatched vulnerabilities in OnePlus software can allow a malicious Android application to gain root-level control of affected devices without requesting any special permissions. Security researcher Rasmus Moorats demonstrated the attack on a stock OnePlus 15 running the latest OxygenOS version, showing that an app installed on the device could escalate its privileges through two flaws in OnePlus-developed services.
The vulnerabilities were found in AtlasService and olc2, two components that operate with elevated system privileges. OnePlus confirmed the issues in May and told Moorats that the flaws could affect additional OnePlus and OPPO devices, although no specific list of affected models has been released. As of the September 24 disclosure, the company had not published a security advisory, assigned CVE identifiers, or released a patch for the flaws.
Two Flaws Form a Single Attack Chain
The first vulnerability affects AtlasService, a OnePlus service used for collecting debugging information. The service runs with root privileges and, according to the research, does not adequately verify which application is making a request.
A specially crafted request can reach a debugging function that places attacker-controlled input into a system command. This allows a malicious application to execute commands with root privileges, although the initial access remains confined to the restricted dumpstate environment.
The second vulnerability involves olc2, a hardware-related service that can execute shell commands. Its access control assumes that requests come from an already privileged process.
Since the first flaw provides root execution within the restricted environment, the attacker can use that access to reach the second service.
The resulting execution takes place in a less restricted system context, providing significantly broader Linux privileges. The research shows that the chain can ultimately allow kernel code to be loaded, moving the attack from application-level compromise to deep system control.
No Special Permissions Required
The attack does not depend on a remote network connection. A malicious application must first be installed and running on the device, but the application does not need to request sensitive Android permissions or obtain an additional consent prompt.
The demonstration was carried out on an unmodified OnePlus 15, indicating that the attack does not require an already rooted or specially configured device. Moorats also tested the chain against a OnePlus 12 Pro and expects the vulnerabilities to affect a wider range of devices running OxygenOS 16.
OnePlus has indicated that the issues extend beyond its own devices to some OPPO products, reflecting the shared software components used across the two companies. However, the exact scope remains unclear because neither company has published an affected-device list.
There is currently no evidence that the vulnerabilities have been exploited in real-world attacks.
The immediate risk is tied to malicious applications being installed on affected devices, making application-source security an important defensive measure while a vendor fix remains unavailable.
Disclosure Followed Months of Vendor Coordination
Moorats reported the vulnerabilities to OnePlus on April 18, 2026. The company confirmed the issues on May 20 and said a fix was being prepared, while also asking the researcher not to disclose the technical details publicly.
A further update arrived on June 22, when OnePlus requested additional time before disclosure. Moorats agreed to delay publication until September 17.
Requests for further updates on July 20 and September 11 reportedly received no response.
The technical details were eventually published on September 24, while the flaws remained unpatched.
Until an official update becomes available, limiting application installations to trusted sources can reduce exposure to the attack path. A malicious application must be present on the device before the exploit chain can be triggered.
Wider Impact Across OnePlus and OPPO Devices
The disclosure raises broader concerns because the affected components are part of the software layer added by the device manufacturer rather than stock Android. Mallory's analysis identifies the tested OnePlus 15 firmware as OxygenOS 16.0.3.503 and also records successful testing on the OnePlus 12 Pro.
While OnePlus acknowledges that multiple products and software versions are vulnerable, it has not provided a comprehensive list of affected devices. There is also a significant connection between OnePlus and OPPO The two companies share software components, which means a flaw in an OEM service could affect more than just OnePlus smartphones. Information available does not establish the full impact of OPPO, however, and specific affected versions remain uncertain.
In the attack chain, two separate security weaknesses are exploited. AtlasService provides a path for untrusted applications to be able to communicate
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: