Unprecedented Root Vulnerability Discovered in OnePlus Devices
A recent disclosure by security researcher Rasmus Moorats reveals a severe flaw in the OxygenOS operating system that allows any installed Android application to acquire root privileges without requesting additional permissions. The vulnerability chain exploits two distinct services native to OnePlus firmware, giving attackers unrestricted access to the underlying Linux kernel.
How the Exploit Works
- Stage One – AtlasService Abuse: AtlasService, intended for collecting debugging data, runs with root privileges. It accepts calls from any app without validating the caller’s identity. By sending a crafted request, an attacker can inject shell commands that grant limited root access within a sandboxed area.
- Stage Two – olc2 Elevation: The second service, olc2, is a hardware helper that can execute arbitrary shell commands but normally requires the caller to be root. Once the first stage establishes initial root rights, the malicious application invokes olc2 to run system commands that elevate privileges to full Linux control, including kernel module loading.
Devices Affected
The researcher demonstrated the attack on a OnePlus 15 running the latest OxygenOS release as well as an older OnePlus 12 Pro. OnePlus confirmed that the same flaw spans a wide range of its own devices and extends to OPPO phones built on shared software components. Consequently, the entire OxygenOS 16 family is likely compromised until a patch is issued.
Current Situation
As of the latest public statements, OnePlus has not released a fix for these vulnerabilities. The researcher chose to disclose the findings publicly after the company indicated it held the exclusive right to vulnerability disclosure and threatened potential legal action. No confirmed real-world exploitation has been reported, but the technical possibility presents a significant risk to any user who installs third‑party applications.
Broader Landscape of OEM Vulnerabilities
OnePlus is not the only manufacturer facing similar challenges. In late 2026, researchers uncovered root‑exposure flaws in devices from Samsung, Xiaomi, Realme, and other flagship brands, all tied to manufacturer‑added software layers rather than core Android. Additional security incidents include a session‑takeover vulnerability in OnePlus 13R and a data‑access flaw that allowed apps to read SMS content without permissions.
Mitigation Recommendations
- Install applications only from trusted sources such as the official Google Play Store.
- Regularly review app permission requests and avoid granting unnecessary or suspicious permissions.
- Monitor official firmware updates from OnePlus and OPPO and apply them as soon as they become available.
- Consider disabling or uninstalling OEM services that are not essential for daily usage, though this may impact device functionality.
Until a vendor patch is released, the safest approach for users of affected OnePlus and OPPO models is to exercise extreme caution when downloading or updating applications from third‑party markets.
Leave a Reply