Unpatched One Plus Flaws Let Installed Android Apps Gain Root Without Permissions

Summary: Researcher Rasmus Moorats chained two flaws in OnePlus's own software to gain root on a stock OnePlus 15 running the latest OxygenOS, using an installed app that requests no permissions and shows the user no prompt. OnePlus confirmed both flaws in May and told Moorats the same issues affect many more OnePlus and OPPO devices, but had assigned no CVE and released no fix when he published on September 24.
Key Takeaway: The first flaw is an AtlasService debugging call that runs as root and accepts calls from any app without checking the caller, and the second is an olc2 command that executes any shell instruction once the caller is root - so a single trusted-looking app install is enough to hand over kernel-level control. OnePlus's reply claimed the exclusive final right of vulnerability disclosure and warned of legal liability for publishing, which is the posture researchers are weighing against a five-month wait with no fix shipped.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026