Recent findings have unveiled two critical security vulnerabilities within the latest build of OxygenOS, potentially allowing malicious applications to achieve root access on OnePlus devices, including the OnePlus 15. These flaws exploit privileged services in the operating system, posing a significant risk to user security.
Understanding the Gravity of the Flaws
Typically, Android’s permission prompts serve as a robust defense mechanism, distinguishing untrusted apps from crucial device functionalities. Users often feel secure when an app requests no permissions. However, the identified vulnerabilities in OxygenOS undermine this trust, enabling unauthorized access to system components with elevated privileges.
Security researcher Rasmus Moorats brought these concerns to OnePlus’s attention. The company acknowledged the validity of the report, indicating that its security team is actively working on remediation strategies. An email from May 20, 2026, from the OnePlus Security Response Center highlighted that these issues affect a broad range of OPPO products, suggesting shared vulnerabilities across the OPPO ecosystem.
Implications of Zero-Permission Vulnerabilities
The crux of the threat lies in the exposure of privileged OxygenOS services to apps installed on the device. If these services lack stringent enforcement of caller identity and input validation, malicious applications could potentially execute harmful operations with root-level access, Android’s highest privilege level.
This unauthorized root access could enable attackers to manipulate protected data, alter security settings, install persistent software, disrupt other applications, or disable security tools. The severity of the impact hinges on service behavior, device configuration, and any additional conditions necessary for exploitation.
While no public proof-of-concept or exploit details are currently available, OnePlus has requested that the researcher refrain from publishing a comprehensive technical analysis or exploitation methods, even after the security patches are released.
OnePlus’s Response and Recommendations
OnePlus has emphasized its control over the public disclosure of vulnerabilities through its security program. The company plans to announce unified updates and credit the researchers upon the complete release of fixes. Users are strongly advised to install OxygenOS security updates promptly.
In the interim, individuals should avoid downloading apps from untrusted sources, routinely review installed applications, and remove any unfamiliar software. Enterprise administrators managing OnePlus and OPPO devices should ensure timely application of operating-system updates and restrict app installations from unofficial sources.
This situation underscores the inherent risks associated with privileged Android vendor services. Even with a robust permission model, a single exposed system service can allow low-privilege apps to gain unintended control, highlighting the importance of vigilant security practices and timely updates.
