Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions
Unpatched OnePlus flaws let a no-permission Android app gain root on OxygenOS phones, with no fix released.
Researcher Rasmus Moorats disclosed two unpatched OnePlus flaws that let a locally installed Android app with no permissions gain root on a stock OnePlus 15 running the latest OxygenOS. AtlasService, running as root, accepts calls from any app and passes unsanitized input into a system command; a second service, olc2, then runs arbitrary shell commands with full low-level privileges. OnePlus confirmed both issues in May 2026, said more OnePlus and OPPO devices are affected, and had assigned no CVE or released a fix by the September 24 publication. There is no evidence of in-the-wild use.
- A no-permission app can root stock OxygenOS via AtlasService and olc2.
- OnePlus confirmed both flaws in May 2026 and had shipped no fix by disclosure.
- No CVE was assigned; OnePlus and OPPO devices on shared software may be affected.
- The attack is local only, and no real-world exploitation is reported.
- Products
- OxygenOSOnePlus 15OnePlus 12 Pro
- Organizations
- Rapid7
From the original article
3 min read at thehackernews.com
A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus's own software to gain root access, the highest level of control over an Android phone. OnePlus told him the same flaws affect many more of its own devices and those of OPPO, though it has not
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.