Unpatched OnePlus OxygenOS flaws can give apps root

Two unpatched OxygenOS flaws can let a no-permission app gain root on OnePlus devices, with no CVE and no shipped fix reported.

Researcher Rasmus Moorats disclosed two unpatched OnePlus OxygenOS flaws that let a locally installed Android app with no permissions gain root on a stock OnePlus 15 running the latest OxygenOS. The Hacker News identifies AtlasService, which runs as root and passes unsanitized input into a system command, and olc2, which then runs arbitrary shell commands with full low-level privileges; Cyber Security News describes the same issue more generally as abuse of exposed privileged services. In a May 20, 2026 email, OnePlus said its security team validated the issues and that they affect OPPO products sharing the components, with The Hacker News also reporting other OnePlus devices may be affected. No CVE was assigned, no public proof-of-concept was included, and neither outlet reported in-the-wild use. The sources differ on remediation: The Hacker News says no fix had been released by September 24, 2026, while Cyber Security News says OnePlus scheduled fixes, asked that full technical details not be published, and will credit researchers after patches ship.

• Researcher Rasmus Moorats disclosed two unpatched OxygenOS flaws on a stock OnePlus 15 running the latest OxygenOS.
• A locally installed Android app with no permissions can gain root; The Hacker News names AtlasService (root, unsanitized input into a system command) and olc2 (arbitrary shell commands).
• OnePlus validated both issues in a May 20, 2026 email and said shared components affect other OnePlus and OPPO devices.
• No CVE was assigned, and The Hacker News says no fix had shipped by its September 24, 2026 report.
• No public proof-of-concept was included, and neither report cites in-the-wild exploitation.
• OnePlus asked that full technical details not be published and said researchers would be credited after fixes ship.