A serious chain of vulnerabilities in OnePlus could allow a malicious app to gain root privileges on devices running the latest version of OxygenOS, without first asking for dangerous or special permissions from the user.
The problem was discovered by security researcher Rasmus Moorats, who managed to combine two different security vulnerabilities in OnePlus software and turn a seemingly limited access into full control of the operating system.
The significance of the finding is particularly great, as root privileges are the highest level of control on an Android smartphone. An attacker who gains such access can, depending on the device's other security measures , bypass important operating system restrictions and gain capabilities that are not normally available in a simple application.
OnePlus: Two vulnerabilities that work as a "chain"
The attack is initially based on the AtlasService, a OnePlus component used to collect debugging data. The critical element is that the service runs with root privileges and can accept calls from applications without adequately verifying which application is making the call.
Moorats found that a specially crafted call can pass data to a OnePlus debugging tool, where the app's content ends up as a system command without the necessary verification.
See also: OnePlus: Vulnerability in OxygenOS allows apps to read SMS
This way, the malicious application initially gains limited root access within the dumpstate. This is an important step, but by itself does not provide complete control of the device.
Here comes the second vulnerability.
The second gap paves the way for full control
OnePlus has another component, known as olc2, which acts as a hardware communication helper. This component has a function that can execute shell commands.
In theory, the function is protected because it requires the caller to already have root privileges. In practice, however, this requirement is already met through the first vulnerability.
This creates a two-stage attack chain. The first vulnerability provides initial access, and the second extends it to an environment with much stronger Linux privileges.
In the final stage, the attacker can even reach code injection capabilities in the Linux kernel. This means that the application is no longer limited to the level of a regular Android application, but gains system-level control capabilities.
No special permissions are required from the user
One of the most worrying aspects of the attack is the way it starts. The user is not required to grant any special permissions to the application, nor is there necessarily a warning displayed that reveals its actual activity.
However, there is one important limitation: the attack is local. The user must first install and run the malicious application on their device. Therefore, this scenario does not by itself allow a remote attacker to take control of a phone over the internet.
Moorats was able to replicate the attack on a device with factory software, without any previous modifications. He also confirmed the behavior on an older OnePlus model, suggesting that the issue may be more widespread with OxygenOS 16.
OnePlus also informed the researcher that the same issues affect more of the company's devices, as well as OPPO, but did not disclose a specific list of compatible devices.
See also: OnePlus: Finally leaving the US and Europe — what happens to the devices
Disagreement over the publication of findings
The revelation was accompanied by a disagreement between the researcher and OnePlus over when and how the technical details should be made public.
Moorats reported the vulnerabilities to the company on April 18, 2026.On May 20, OnePlus confirmed the two vulnerabilities and stated that it retains final control over the disclosure process, while warning of potential legal consequences if data was published without its consent.
In June, the company said it was working on a fix and asked for more time. The researcher agreed to delay publication until September 17. After further requests for information, which he said went unanswered, he finally decided to publish the findings on September 24.
OnePlus argued that European cybersecurity rules oblige manufacturers to accept and address vulnerability reports, but it does not believe this gives researchers the right to independently publish full technical details.
What users can do
Until there is an official security update, the most important practical protection is relatively simple: avoid installing applications from untrusted sources.
This particular attack requires the presence of a malicious application on the device. Therefore, paying attention to the origin of the applications significantly limits this particular attack scenario.
Until the findings were made public, there was no indication that the vulnerabilities had already been exploited in real attacks. At the same time, no relevant CVE or official patch update to name and address the two gaps.
See also: OnePlus: Withdrawal from the US and Europe?
It's not the first incident
The case adds to a series of investigations showing that pre-installed components from manufacturers can create serious risks even on fully updated Android smartphones.
In August, researcher Lukas Maar presented a different technique that could lead to root access via an app without special permissions on devices from Samsung, Xiaomi, OPPO, OnePlus, and Realme.
At the same time, in 2025 Rapid7 had reported a different issue in OxygenOS, which could allow applications to gain access to the user's SMS.
The new research highlights a broader issue for the Android ecosystem: even when the operating system core is up to date, additional services and tools installed by the manufacturer can be a critical entry point for an attack. For users, installing apps only from trusted sources remains one of the most basic defenses, while for manufacturers, this case highlights the importance of strict access control between pre-installed services.
