Unpatched vulnerabilities in OnePlus software can allow a malicious Android application to gain root-level control of affected devices without requesting any special permissions. Security researcher Rasmus Moorats demonstrated the attack on a stock OnePlus 15 running the latest OxygenOS version, showing that an app installed on the device could escalate its privileges through two flaws in OnePlus-developed services.
The vulnerabilities were found in AtlasService and olc2, two components that operate with elevated system privileges. OnePlus confirmed the issues in May and told Moorats that the flaws could affect additional OnePlus and OPPO devices, although no specific list of affected models has been released. As of the September 24 disclosure, the company had not published a security advisory, assigned CVE identifiers, or released a patch for the flaws.
Two Flaws Form a Single Attack Chain
The first vulnerability affects AtlasService, a OnePlus service used for collecting debugging information. The service runs with root privileges and, according to the research, does not adequately verify which application is making a request.
A specially crafted request can reach a debugging function that places attacker-controlled input into a system command. This allows a malicious application to execute commands with root privileges, although the initial access remains confined to the restricted dumpstate environment.
The second vulnerability involves olc2, a hardware-related service that can execute shell commands. Its access control assumes that requests come from an already privileged process.
Since the first flaw provides root execution within the restricted environment, the attacker can use that access to reach the second service.
The resulting execution takes place in a less restricted system context, providing significantly broader Linux privileges. The research shows that the chain can ultimately allow kernel code to be loaded, moving the attack from application-level compromise to deep system control.
No Special Permissions Required
The attack does not depend on a remote network connection. A malicious application must first be installed and running on the device, but the application does not need to request sensitive Android permissions or obtain an additional consent prompt.
The demonstration was carried out on an unmodified OnePlus 15, indicating that the attack does not require an already rooted or specially configured device. Moorats also tested the chain against a OnePlus 12 Pro and expects the vulnerabilities to affect a wider range of devices running OxygenOS 16.
OnePlus has indicated that the issues extend beyond its own devices to some OPPO products, reflecting the shared software components used across the two companies. However, the exact scope remains unclear because neither company has published an affected-device list.
There is currently no evidence that the vulnerabilities have been exploited in real-world attacks.
The immediate risk is tied to malicious applications being installed on affected devices, making application-source security an important defensive measure while a vendor fix remains unavailable.
Disclosure Followed Months of Vendor Coordination
Moorats reported the vulnerabilities to OnePlus on April 18, 2026. The company confirmed the issues on May 20 and said a fix was being prepared, while also asking the researcher not to disclose the technical details publicly.
A further update arrived on June 22, when OnePlus requested additional time before disclosure. Moorats agreed to delay publication until September 17.
Requests for further updates on July 20 and September 11 reportedly received no response.
The technical details were eventually published on September 24, while the flaws remained unpatched.
Until an official update becomes available, limiting application installations to trusted sources can reduce exposure to the attack path. A malicious application must be present on the device before the exploit chain can be triggered.
Wider Impact Across OnePlus and OPPO Devices
The disclosure raises broader concerns because the affected components are part of the software layer added by the device manufacturer rather than stock Android. Mallory's analysis identifies the tested OnePlus 15 firmware as OxygenOS 16.0.3.503 and also records successful testing on the OnePlus 12 Pro.
While OnePlus acknowledges that multiple products and software versions are vulnerable, it has not provided a comprehensive list of affected devices. There is also a significant connection between OnePlus and OPPO The two companies share software components, which means a flaw in an OEM service could affect more than just OnePlus smartphones. Information available does not establish the full impact of OPPO, however, and specific affected versions remain uncertain.
In the attack chain, two separate security weaknesses are exploited. AtlasService provides a path for untrusted applications to be able to communicate with privileged OnePlus processes, whereas the vendor component Olc2 allows another path for executing commands within privileged environments. These flaws allow initial restricted access to reach a much more powerful system environment through the use of their combined effects.
OEM Software Remains a Key Android Attack Surface
OnePlus' disclosure follows another demonstration in which manufacturer-specific Android software was demonstrated in September. Security researcher Lukas Maar presented OEMPocalypse research, which demonstrated privilege-escalation chains against several major Android manufacturers, including OnePlus, Samsung, Xiaomi, OPPO, and Realme. This research involved a different technical approach, involving an OEM sandbox escape followed by a memory safety flaw in a vendor kernel driver.
The overlap is in the attack surface: both cases depend on code added by smartphone manufacturers rather than a weakness in the core Android framework. In addition to hardware control and diagnostic functions, OEM components often require elevated privileges due to their device-specific features.
As a result of these privileges, insufficient access checks are also particularly critical.
The inclusion of a vulnerable service that accepts requests from ordinary applications can provide a path that circumvents Android's normal security controls.
No Exploitation Reported So Far
The OnePlus flaws have not yet been exploited in the wild, according to information provided by OnePlus. Furthermore, the disclosed attack is not remotely exploitable, since a malicious application must already be installed on the device. Although the requirement is met, it does not eliminate the risk of an exploit.
An application that is distributed through an unofficial store, a malicious APK, or another untrusted software channel may have the potential to provide an entry point for an exploit.
A conventional permission-based screening method is less effective against this particular attack chain because the application does not require special Android permissions.
Until OnePlus releases a security update, limiting application installations to trusted sources remains the primary practical precaution. Regular checks of OxygenOS updates are also relevant, since no public remediation timeline was available at the time of disclosure.
Disclosure Raises Questions Over Patch Coordination
A vulnerability disclosure also emphasizes the extended coordination period between the researcher and OnePlus as a result of the issue being reported on April 18, OnePlus confirmed the issue in May, and provided a second fix status update in June.
OnePlus argued during the disclosure process that vulnerability publication should remain within their control during the disclosure process. Publication ultimately took place on September 24 without a public patch.
Although the researcher released their findings following the expiration of the agreed-upon disclosure period without any public remediation, no CVE identifier was assigned to the vulnerabilities as of publication, and no OnePlus advisory was publicly available describing the affected builds or recommending possible fixes.
The absence of these details makes it difficult to determine the exact scope and makes the eventual security update particularly important for confirming which devices are affected.
A similar case occurred in 2025 in which Rapid7 disclosed a separate OxygenOS vulnerability that could permit applications to access SMS data, adding to concerns about vulnerabilities in manufacturer-specific services rather than the core platform of Android.
.jpg "F5 Fixes BIG-IP APM Zero-Day Enabling Unauthenticated RCE")
.jpg)
