OnePlus 15 Flaws Let Zero-Permission Apps Gain Root Access Through OxygenOS Services
OxygenOS flaws could let zero-permission apps gain root on OnePlus and OPPO devices.
Researcher Rasmus Moorats reported two OxygenOS flaws that could let Android apps with no permissions run attacker-controlled code as root on OnePlus devices, including the OnePlus 15, by abusing exposed privileged services. In a May 20, 2026 email, OnePlus said its security team validated the issues and that they affect OPPO terminal products sharing the components. No public proof-of-concept was included, and the report does not say the bugs are being exploited. OnePlus asked that full technical details not be published and said it will credit researchers after fixes ship.
- Two OxygenOS flaws could give zero-permission apps root on OnePlus phones.
- OnePlus says the vulnerable components are shared across OPPO products.
- Vendor validated the May 2026 report and scheduled fixes; no CVE is named.
- No public exploit was released, and in-the-wild use is not reported.
- Products
- OxygenOSOnePlus 15Android
From the original article
2 min read at cybersecuritynews.com
Two flaws in the latest OxygenOS build could let malicious Android apps run code with root privileges on OnePlus devices, including the OnePlus 15, by exploiting accessible privileged services. The vulnerabilities are significant because Android permission prompts normally act as a barrier between untrusted apps and sensitive device functions. A user may reasonably assume that […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.