OnePlus OxygenOS Flaws Allow Root Without Permissions

A security researcher has published details of two unpatched flaws in OnePlus phone software that allow any installed Android app to silently gain root access without asking for permissions. Rasmus Moorats demonstrated the chain on a OnePlus 15 running the latest OxygenOS, the version of Android used by OnePlus phones. One malicious app that the owner installs, one that requests no special permissions, can take control of the device at the system level. OnePlus confirmed both flaws in May 2026, but as of Moorats's public disclosure on September 24 it had released no fix and no security advisory naming the issues.

The two flaws sit in OnePlus's own preinstalled software, not in the core Android operating system. The first flaw is in AtlasService, a service that gathers debugging data, runs with root privileges, and accepts calls from any app without checking who is calling. A crafted call reaches a OnePlus debugging tool that takes text supplied by the app and drops it, unchecked, into a system command. That action hands the app root access, but only inside a restricted system zone called dumpstate, which cannot do everything root normally can. The researcher describes this as the first step, not the complete takeover.

The second flaw finishes the job. OnePlus ships another service, a hardware helper named olc2, with a command that executes any shell instruction it receives. Its only guard is that the caller must already hold root privileges, and the first flaw provides exactly that. This time the command runs in a zone that grants all low-level Linux privileges, including the ability to load kernel code. Moorats states that gives the app control of the device at the system level, meaning the attacker could change system settings, access data, or install other software.

The attack is local, not remote. A malicious app has to be installed and running on the phone first, so it cannot be launched over the internet. But once it is there, the app needs no permissions, shows the user no prompt, and the researcher demonstrated it on a stock OnePlus 15 that had not been modified. He also confirmed the chain on an older OnePlus 12 Pro and said he expects the same problem across OxygenOS 16 in general. OnePlus and OPPO build their phones on shared software, and OnePlus told Moorats that the same flaws affect many more of its own devices and OPPO devices, although it has not named the affected models. There is no evidence that anyone has used these flaws in a real attack.

The disclosure timeline that Moorats published covers about five months. He reported both flaws to OnePlus on April 18, 2026. On May 20 OnePlus confirmed them, told him it alone decides when to make a flaw public, and warned that publishing without its permission could result in legal liability. On June 22 the company gave an update on its fix and asked him to hold off, and he agreed not to publish before September 17. After that, on July 20 and September 11, he asked for updates and received no reply. He published on September 24.

OnePlus set out its position in the reply, which Moorats published in full. The company said a fix was scheduled, but claimed the exclusive final right to decide vulnerability disclosure, and told him that even after a fix ships, researchers may not publish full technical details on their own. OnePlus argued that European cybersecurity rules require makers to accept and fix reports but do not allow researchers to disclose them without the maker's consent. It warned that if he published without permission, it would pursue relevant legal liabilities in accordance with applicable laws.

This is not the only recent example of an installed app reaching root on flagship Android phones. In August, Lukas Maar, a researcher at the security firm Calif, showed a different technique that took a no-permission app to root locked phones running the latest firmware from Samsung, Xiaomi, OPPO, OnePlus, and Realme by attacking code the makers add to Android. OnePlus has also been slow to answer researchers before. In 2025, Rapid7 reported a separate OxygenOS flaw that let any app read a user's texts, and said OnePlus did not respond until the research was public.

As of Moorats's disclosure, OnePlus had assigned no CVE identifier and released no fix, and no OnePlus advisory naming the flaws could be found. Until a patch ships, the one practical defense is to block the thing the attack needs to get started: install apps only from sources you trust, because the attack cannot run without a malicious app on the phone. For IT teams managing fleets of Android devices, AEU-I offers security-first IT and consulting that can help assess device exposure and restrict risky app installs while waiting for a vendor patch.