Recent findings have revealed significant security vulnerabilities in OnePlus devices, allowing malicious apps to gain root access without user consent. Security researcher Rasmus Moorats identified these issues in the OnePlus 15 running the newest OxygenOS, demonstrating that apps could exploit these flaws without needing special permissions.
Discovery of the Security Flaws
Moorats uncovered two key vulnerabilities within OnePlus’s software that, when combined, enable unauthorized root access. Root access grants the highest level of control on Android devices, posing substantial security risks. OnePlus confirmed the presence of these flaws across multiple devices, including those from OPPO, yet has not specified which models are affected.
The company acknowledged these vulnerabilities in May but insisted on controlling the disclosure process. Despite warning Moorats against publishing without permission, he released his findings on September 24, citing the lack of a provided fix as a driving factor.
Technical Details of the Exploitation
The first flaw resides in the OnePlus service called AtlasService, which collects debugging data and operates with root access. This service can be accessed by any app, allowing malicious software to exploit it and execute commands within a restricted system area known as dumpstate.
The second vulnerability involves the olc2 service, which executes commands and requires existing root access, a condition met by exploiting the first flaw. This combination allows apps to gain comprehensive control over the device, including loading kernel code.
Impact and User Precautions
The vulnerabilities require a malicious app to be installed and operational, meaning the threat is local and cannot be executed remotely. Users are advised to install apps only from trusted sources, as the attack cannot proceed without a malicious app already on the device.
While there is no evidence of these vulnerabilities being exploited in real-world attacks, the security implications are significant. Moorats’s findings suggest the flaws could affect not only the OnePlus 15 but also older models like the OnePlus 12 Pro and potentially the entire OxygenOS 16 lineup.
OnePlus has yet to release a patch or advisory regarding these issues, and no CVE has been assigned. This situation underscores the importance of cautious app installation practices until a comprehensive fix is available.
Broader Security Concerns
This is not an isolated incident of security lapses in flagship Android devices. In August, researcher Lukas Maar identified a method to gain root access on various brands, including Samsung, Xiaomi, and Realme, by exploiting manufacturer-added code.
OnePlus’s slow response to security reports is not unprecedented. In 2025, a separate flaw in OxygenOS allowing unauthorized access to text messages was only addressed after public disclosure by Rapid7.
As the tech industry grapples with these challenges, users must remain vigilant and prioritize device security through cautious application management and timely software updates.
