Full Report
A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus's own software to gain root access, the highest level of control over an Android phone. OnePlus told him the same flaws affect many more of its own devices and those of OPPO, though it has not
Analysis Summary
# Vulnerability: OnePlus/OPPO Privilege Escalation to Root (Exploit Chain)
## CVE Details
- **CVE ID:** Not yet assigned (as of September 24, 2026)
- **CVSS Score:** N/A (Estimated **High/Critical** due to full root access)
- **CWE:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-285 (Improper Authorization)
## Affected Systems
- **Products:** OnePlus and OPPO smartphones running OxygenOS/ColorOS.
- **Versions:** Confirmed on OnePlus 15 (OxygenOS 16) and OnePlus 12 Pro. The researcher expects the flaw to persist across OxygenOS 16 generally.
- **Configurations:** Stock firmware; requires no special user permissions or device modifications (e.g., Bootloader unlocking is not required).
## Vulnerability Description
The vulnerability consists of a chain of two flaws within proprietary OnePlus software services:
1. **AtlasService Logic Flaw:** A service responsible for gathering debugging data (`AtlasService`) runs with root privileges but lacks access control, allowing any installed app to call it. A crafted call reaches a debugging tool that fails to sanitize input, leading to **command injection**. This grants the attacker root access, albeit restricted within the `dumpstate` SELinux domain.
2. **olc2 Hardware Helper Bypass:** To escape the restricted domain, the attacker calls the `olc2` service. This service contains a command that executes any received shell instruction. Its only security check is verifying if the caller is already "root." Since the first flaw provides restricted root status, the second flaw allows the execution of arbitrary instructions in a domain with full Linux privileges, including kernel code loading.
## Exploitation
- **Status:** PoC available (Published by researcher Rasmus Moorats). Not currently known to be exploited in the wild.
- **Complexity:** Medium (Requires chaining two specific service vulnerabilities).
- **Attack Vector:** Local (Requires a malicious app to be installed on the device).
## Impact
- **Confidentiality:** Total (Full access to all user data, messages, and system files).
- **Integrity:** Total (Ability to modify system files and load kernel code).
- **Availability:** Total (Ability to brick the device or disable services).
## Remediation
### Patches
- **None currently available.** As of the disclosure date (Sept 24, 2026), OnePlus has confirmed the flaws but has not yet released a public firmware update or security patch.
### Workarounds
- **Strict App Hygiene:** Users should only install applications from highly trusted sources (e.g., official Play Store apps from reputable developers). The exploit requires a malicious app to be present on the local storage to initiate the chain.
- **Avoid Sideloading:** Do not install APKs from third-party websites or untrusted repositories until a patch is issued.
## Detection
- **Indicators of Compromise:** Presence of unauthorized processes running with UID 0 (root) originating from non-system apps. Unexpected behavior in `AtlasService` or `olc2` logs.
- **Detection methods:** Currently limited on non-rooted devices; however, security suites that monitor for unusual inter-process communication (IPC) to system debugging services may flag the activity.
## References
- **Researcher Blog:** hxxps[://]blog[.]nns[.]ee/2026/09/24/oneplus-root/
- **Vendor Correspondence:** hxxps[://]blog[.]nns[.]ee/raw/2026-09-24-oneplus-root/2026-05-20-oneplus-email[.]txt
- **News Source:** hxxps[://]thehackernews[.]com/2026/09/unpatched-oneplus-flaws-let-installed[.]html