OnePlus (Vendor): news timeline & CVEs

OnePlus 15 Flaws Let Zero-Permission Apps Gain Root Access Through OxygenOS Services

OxygenOS flaws could let zero-permission apps gain root on OnePlus and OPPO devices.

Researcher Rasmus Moorats reported two OxygenOS flaws that could let Android apps with no permissions run attacker-controlled code as root on OnePlus devices, including the OnePlus 15, by abusing exposed privileged services. In a May 20, 2026 email, OnePlus said its security team validated the issues and that they affect OPPO terminal products sharing the components. No public proof-of-concept was included, and the report does not say the bugs are being exploited. OnePlus asked that full technical details not be published and said it will credit researchers after fixes ship.

Cyber Security NewsSep 25, 18:02 UTC · 1d agoVulnerability 2 sources

Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions

Unpatched OnePlus flaws let a no-permission Android app gain root on OxygenOS phones, with no fix released.

Researcher Rasmus Moorats disclosed two unpatched OnePlus flaws that let a locally installed Android app with no permissions gain root on a stock OnePlus 15 running the latest OxygenOS. AtlasService, running as root, accepts calls from any app and passes unsanitized input into a system command; a second service, olc2, then runs arbitrary shell commands with full low-level privileges. OnePlus confirmed both issues in May 2026, said more OnePlus and OPPO devices are affected, and had assigned no CVE or released a fix by the September 24 publication. There is no evidence of in-the-wild use.

The Hacker Newsupdated Sep 25, 18:02 UTC · 1d agofirst Sep 24, 18:10 UTC · 2d agoVulnerability 2 sources

OnePlus

Timeline2 articles

Appears with

OnePlus 15 Flaws Let Zero-Permission Apps Gain Root Access Through OxygenOS Services

Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions