The company confirmed the vulnerabilities in May and was preparing a fix, but no security update was available when the findings were disclosed yet.
The vulnerabilities are said to affect the OnePlus 15 (pictured) and the older 12 Pro
OnePlus is reportedly facing a serious security issue that could allow a malicious Android app to gain root access without requesting any permissions. Ethical hacker Rasmus Moorats found two vulnerabilities that can be chained to obtain extensive control over affected devices. The flaws reportedly work on the OnePlus 15 running the latest OxygenOS and may extend to other OnePlus and Oppo phones. OnePlus confirmed the issues months ago, but had not released a fix when Moorats published his findings in September.
According to a blog post by ethical hacker Rasmus Moorats, the two vulnerabilities can reportedly be chained to take a malicious app from having no special privileges to gaining root access on the phone. The attack is local, meaning the app must first be installed on the device, but it does not need permissions or a user prompt to escalate its access.
The vulnerability has reportedly been reproduced on the OnePlus 12 Pro as well as the OnePlus 15, while the researcher believes other phones running OxygenOS 16 could be vulnerable. OnePlus has also indicated that the issue may extend to some Oppo models, although the affected devices have not been identified.
The attack starts with an app that is already present on the phone. That requirement prevents a remote attack, but does not provide much protection once a malicious application has been installed. The app can reportedly operate without requesting access to sensitive permissions or displaying a prompt before attempting the privilege escalation.
Moorats traced the problem to two OnePlus services. One of them, AtlasService, operates with root privileges and handles debugging functions. The researcher found that applications could interact with the service without adequate checks, allowing specially crafted data to reach a system utility and trigger commands with elevated privileges.
That initial access is restricted to a system area called dumpstate. On its own, it does not provide complete control of the phone. Moorats found that another component, called olc2, could be used to take the attack further because it accepts shell commands from processes that already have root access.
By combining the two weaknesses, the malicious app can reportedly reach a more powerful execution environment. This provides access to low-level Linux capabilities and could allow kernel code to be loaded, giving the attacker extensive control over the device.
OnePlus was first alerted to the vulnerabilities on April 18, 2026, and confirmed the issues on May 20. The company said a fix was being prepared and later asked for the disclosure to be delayed. The researcher agreed to hold the findings until September 17, but further requests for an update on July 20 and September 11 reportedly went unanswered. The vulnerabilities were subsequently disclosed publicly on September 24, with no patch available at the time.
OnePlus had reportedly not assigned a CVE identifier to the vulnerabilities or published an advisory covering them at the time of disclosure. There was also no indication that the flaws had been used in attacks against users.
The immediate precaution is to be selective about which applications are installed on the phone. Since the demonstrated attack depends on a malicious app being present locally, avoiding applications from untrusted sources can prevent the exploit from getting the initial foothold it requires.
The findings are part of a wider pattern of security research targeting additional software that smartphone makers add to Android. In August, researcher Lukas Maar demonstrated a separate root-access technique involving current firmware from Samsung, Xiaomi, Oppo, OnePlus and Realme. That method also involved a permissionless application, but used different manufacturer components.
OnePlus has previously faced scrutiny over other OxygenOS vulnerabilities. Rapid7 disclosed a separate issue in 2025 that reportedly allowed applications to access users' text messages. The security firm said the company responded after the research became public.
Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.