OnePlus 15 Flaws Let Zero-Permission Apps Gain Root Access Through OxygenOS Services
OxygenOS flaws could let zero-permission apps gain root on OnePlus and OPPO devices.
Researcher Rasmus Moorats reported two OxygenOS flaws that could let Android apps with no permissions run attacker-controlled code as root on OnePlus devices, including the OnePlus 15, by abusing exposed privileged services. In a May 20, 2026 email, OnePlus said its security team validated the issues and that they affect OPPO terminal products sharing the components. No public proof-of-concept was included, and the report does not say the bugs are being exploited. OnePlus asked that full technical details not be published and said it will credit researchers after fixes ship.
- Two OxygenOS flaws could give zero-permission apps root on OnePlus phones.
- OnePlus says the vulnerable components are shared across OPPO products.
- Vendor validated the May 2026 report and scheduled fixes; no CVE is named.
- No public exploit was released, and in-the-wild use is not reported.
Full article500 words · extracted from cybersecuritynews.com · click to collapse
Two flaws in the latest OxygenOS build could let malicious Android apps run code with root privileges on OnePlus devices, including the OnePlus 15, by exploiting accessible privileged services.
The vulnerabilities are significant because Android permission prompts normally act as a barrier between untrusted apps and sensitive device functions. A user may reasonably assume that an app requesting no permissions has limited capabilities.
However, the reported OxygenOS flaws could bypass that expectation by abusing system components already running with elevated privileges.
Researcher Rasmus Moorats submitted the findings to OnePlus, which confirmed that its security team had validated the report and scheduled remediation.
In an email dated May 20, 2026, the OnePlus Security Response Center said the issues affect “all series of OPPO terminal products with universal security risks,” indicating the underlying vulnerable components may be shared across the wider OPPO ecosystem.
OnePlus 15 Zero-Permission Flaws
The attack scenario centers on privileged OxygenOS services exposed to applications installed on the phone. If a service does not adequately enforce caller identity, signature-level permissions, or input validation, an untrusted application may send crafted requests to trigger dangerous operations.
In this case, the alleged outcome is execution of attacker-controlled code as root, Android’s most privileged account. Root access would give an attacker broad control over a device.
A malicious app could access protected data, modify security settings, install persistent components, interfere with other apps, or turn off security tools. The impact would depend on the exact service behavior, device configuration, and whether exploitation requires additional conditions.
No public proof-of-concept or technical exploit details were included in the supplied disclosure. OnePlus asked the researcher not to independently publish a complete technical analysis, exploitation method, or risk mechanism, including after security fixes have been rolled out.
The company stated that it retains final control over public vulnerability disclosures submitted through its security program. OnePlus also directed the researcher to its official security platform or HackerOne for submission and bounty processing.
The company said it plans to issue a unified public announcement and credit researchers through its security honor list once it fully releases fixes and updates.
Users should install OxygenOS security updates as soon as they become available. Until the vendor publishes affected versions and patch information, users should avoid sideloading apps from untrusted sources, review installed applications, and remove software from unknown developers.
Enterprise administrators should monitor managed OnePlus and OPPO devices for overdue operating-system updates and restrict installation from unofficial app stores.
The case highlights the risks created by privileged Android vendor services. Even when Android’s core permission model is strong, a single exposed system service can let a low-privilege app gain control far beyond the access a user intended to grant.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Abinayahttps://cybersecuritynews.com/
Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.