OnePlus Root Vulnerability Exposes OxygenOS Devices to Malicious Apps Through Chained Flaws

The modern smartphone ecosystem is built upon a delicate balance of convenience, feature richness, and deep architectural security. However, this intricate balance was recently thrown into sharp relief when independent security researcher Rasmus Moorats uncovered a critical security vulnerability chain affecting modern OnePlus and OPPO smartphones running OxygenOS. The discovery highlights the hidden risks lurking within proprietary vendor customizations added on top of the stock Android operating system.

According to technical disclosures published by Moorats on September 24, 2026, a locally installed malicious application requiring zero special runtime permissions can completely compromise a target device, gaining full root-level control. This exploit chain relies on a combination of insecure inter-process communication (IPC) handling and unvalidated command execution within vendor-specific background utilities.

While the attack vector requires a user to first download and install a malicious application, the implications of achieving root privileges without user prompts or explicit permission grants are profound. The disclosure has once again ignited intense debate within the cybersecurity community regarding responsible vulnerability disclosure, vendor accountability, and the legal threats tech companies increasingly direct at independent security researchers.

Anatomy of the Exploit: Chaining Two Flaws for Total Control

To understand the severity of the vulnerability, one must examine how Android’s security sandbox is structured. Standard applications on Android operate within isolated sandboxes designed to restrict their access to sensitive system resources, user data, and hardware features. To break out of this sandbox, applications typically require root access—the highest privilege level in a Unix-like operating system, equivalent to the Linux "superuser."

Moorats successfully achieved root execution on a stock OnePlus 15 running the latest version of OxygenOS by sequentially exploiting two distinct architectural flaws in OnePlus’s proprietary software stack.

The first vulnerability resides within a background service known as AtlasService. Designed primarily to gather diagnostic and debugging data, AtlasService runs natively with root privileges. Crucially, the service suffered from a severe access control oversight: it accepted incoming calls and execution requests from any locally installed application on the device without validating the caller’s identity or privilege level.

By crafting a specialized IPC call, Moorats directed AtlasService to pass arbitrary text data straight into a system debugging utility without proper sanitization or validation. While this initial injection successfully elevated the malicious app’s privileges, it initially did so within a heavily restricted system environment known as dumpstate. This zone is heavily sandboxed compared to full root privileges and cannot execute low-level system modifications or kernel-level operations.

To overcome this limitation, Moorats identified a second vulnerability within olc2, a proprietary hardware helper service bundled with OxygenOS. The olc2 service possessed command-handling logic designed to execute arbitrary shell instructions. The only security check safeguarding this potent capability was that the calling process had to already possess root privileges.

Because the first exploit against AtlasService successfully elevated the application to this prerequisite privilege tier, the malicious app was able to interface directly with olc2. This secondary execution ran within a zone that granted comprehensive, low-level Linux privileges. Armed with this level of access, the attacker can theoretically perform advanced system-level actions, including loading custom kernel modules, bypassing file-system encryption boundaries, and establishing persistent, undetectable surveillance mechanisms.

Scope of Impact and Vulnerable Devices

The security implications of this research extend far beyond a single smartphone model. While Moorats primarily tested and verified the exploit chain on a flagship OnePlus 15 running stock, unmodified firmware, further analysis confirmed that older hardware iterations—such as the OnePlus 12 Pro—are equally susceptible.

Because OnePlus and its sister company, OPPO, operate under parent company Oplus, they share a vast codebase, underlying frameworks, and proprietary background services. Consequently, OnePlus formally confirmed to the researcher during their correspondence that the underlying software vulnerabilities affect a broader portfolio of devices across both the OnePlus and OPPO brands, though the manufacturer has declined to publish an exhaustive list of impacted hardware models.

The attack vector is classified as local, meaning an attacker cannot trigger these flaws remotely over the internet or via a malicious web link. An application must first be resident on the device. However, the vector’s insidious nature lies in its stealth: the malicious app needs no special permissions during installation, generates no runtime permission prompts that might alert the user, and bypasses standard Android permission guardrails entirely by weaponizing trusted OEM system components.

Chronology of the Disclosure Conflict

The timeline surrounding the discovery, reporting, and eventual public disclosure of the vulnerability underscores a widening philosophical and legal chasm between hardware manufacturers and independent security researchers.

The disclosure process spanned approximately five months, marked by tense communications regarding vulnerability ownership, disclosure timelines, and potential legal repercussions:

• May 20, 2026: Rasmus Moorats formally submits comprehensive technical details of the AtlasService and olc2 vulnerability chain to OnePlus through private disclosure channels.
• Late May 2026: OnePlus confirms the validity of both flaws. However, in its official response, the company asserts its "exclusive final right of vulnerability disclosure." OnePlus explicitly warns the researcher that publishing any technical details—even after an official patch has been deployed—could result in legal liability and that the company would pursue relevant legal actions under applicable laws if unauthorized disclosure occurred.
• June through August 2026: OnePlus schedules patches for upcoming software updates but fails to issue immediate emergency hotfixes, release a formal security advisory, or assign Common Vulnerabilities and Exposures (CVE) identifiers to track the bugs.
• September 24, 2026: Citing a lack of released patches and growing concerns over user safety, Moorats breaks his silence, publishing the full technical details of the exploit along with unredacted transcripts of his email correspondence with OnePlus.

The company’s hardline stance leaned heavily on evolving European cybersecurity regulations. OnePlus argued that while European frameworks mandate that device manufacturers must establish mechanisms to accept and remediate vulnerability reports, those same laws allegedly do not protect or authorize independent researchers to publish technical specifics without explicit vendor consent.

Broader Industry Trends and OEM Vulnerabilities

This incident is not an isolated anomaly within the Android original equipment manufacturer (OEM) ecosystem. Security researchers have repeatedly demonstrated that manufacturer-added customizations—often introduced to enhance diagnostics, provide proprietary features, or optimize performance—frequently introduce critical attack surfaces that bypass standard Android security mitigations.

In August 2026, just weeks prior to Moorats’s disclosure, security researcher Lukas Maar of the security firm Calif published research detailing a separate, highly sophisticated exploit technique dubbed "OEMpocalypse." That vulnerability demonstrated how a zero-permission application could achieve root access on locked, up-to-date flagship devices manufactured by Samsung, Xiaomi, OPPO, OnePlus, and Realme by systematically targeting vendor-specific code layers.

Furthermore, OnePlus has faced criticism in the past regarding its responsiveness to vulnerability disclosures. In 2025, security firm Rapid7 disclosed CVE-2025-10184, a severe permission-bypass vulnerability within the OxygenOS telephony provider that allowed arbitrary third-party applications to read private user text messages. According to Rapid7’s public reports at the time, OnePlus exhibited prolonged delays in communication, ultimately leaving the vulnerability unaddressed until public pressure forced vendor remediation.

Implications and Practical Defensive Measures

The OnePlus root vulnerability chain highlights systemic vulnerabilities in how smartphone manufacturers audit proprietary code before deploying it to millions of consumer devices. When background system utilities are configured to accept unrestricted inter-process communication with root-level execution rights, the foundational security architecture of the operating system is effectively undermined from within.

As of the public disclosure, OnePlus had not yet published a dedicated security advisory, assigned tracking CVEs, or released a comprehensive firmware update addressing the core IPC validation flaws across all impacted devices.

For everyday consumers using affected OnePlus and OPPO hardware, the absence of an immediate software patch necessitates strict adherence to defensive mobile hygiene principles. Because the exploit relies on a locally installed malicious application to initiate the attack chain, users must exercise extreme caution regarding software acquisition:

1. Strict App Store Reliance: Avoid sideloading applications from untrusted third-party websites, unverified APK repositories, or unauthenticated messaging links. Download applications exclusively from official, curated marketplaces like the Google Play Store, which employs automated scanning and vetting mechanisms.
2. Scrutinize App Developers: Before installing utility tools, games, or niche applications from unknown developers, verify their reputation, review community feedback, and assess whether the app requests unnecessary permissions, even though this specific exploit requires none.
3. Monitor System Updates: Routinely check device settings for incoming software updates, security patches, and firmware upgrades issued by OnePlus to ensure prompt installation of fixes once they become publicly available.

The unfolding situation surrounding OxygenOS serves as a powerful reminder that device security is only as strong as its weakest component. As hardware manufacturers grapple with complex proprietary codebases, the push-and-pull dynamic between independent researchers exposing security gaps and corporate entities attempting to control disclosure timelines will likely remain a central flashpoint in modern cybersecurity.