OnePlus Devices Vulnerable to Full Root Access Through Unpatched Software Flaws

A critical security oversight affecting the latest OnePlus 15 and several other handsets from the manufacturer, including devices under the OPPO umbrella, has been disclosed by independent security researcher Rasmus Moorats. The vulnerability allows a malicious, zero-permission application to achieve full root-level control over the operating system, effectively bypassing all Android security sandboxing. This discovery has sparked a heated confrontation between the researcher and the manufacturer regarding the ethics of vulnerability disclosure and the timeline for mandatory security patching.

The exploit, which utilizes a chain of two distinct software flaws inherent in the OxygenOS ecosystem, allows an attacker to compromise a device without requiring any user interaction or elevated privileges. Because the attack relies on components pre-installed by the manufacturer, even users who practice diligent app hygiene remain at risk if they inadvertently install a malicious package.

The Anatomy of the Attack

The security compromise is rooted in the architecture of OxygenOS, specifically within system-level services that OnePlus and its parent company, OPPO, have integrated into the Android framework. According to the technical breakdown provided by Moorats, the attack functions through a two-stage chain that escalates local privileges from a standard, non-privileged application to the highest possible system level.

The first stage of the exploit targets a proprietary OnePlus service known as "AtlasService." This service is designed to aggregate debugging data and operates with root privileges by default. Crucially, the service lacks proper input validation or authentication mechanisms for incoming requests. A malicious application can send a specially crafted call to this service, which in turn feeds the attacker’s input into a system command without sanitization. While this initial step grants the application root access, it is initially limited to a restricted sandbox known as "dumpstate." Within this environment, the attacker is capable of executing certain commands but is still theoretically isolated from the wider system kernel.

The second stage of the exploit removes these constraints. The device also includes a hardware-helper service, identified as "olc2," which is tasked with managing low-level hardware interactions. This service contains a command-execution function that requires the caller to already possess root privileges. Because the first flaw provides exactly that, the attacker can use the compromised AtlasService as a bridge to invoke the olc2 service. By doing so, the malicious app gains the ability to execute arbitrary shell instructions with full, unrestricted Linux privileges. This level of access is sufficient to install kernel modules, exfiltrate sensitive data from encrypted containers, or establish persistence that survives a device reboot.

A Chronology of Disclosure and Conflict

The discovery highlights a recurring friction point in modern cybersecurity: the tension between researchers advocating for public safety and corporations attempting to control the narrative surrounding their products.

Moorats first identified these vulnerabilities and initiated the disclosure process in May 2026. Upon confirmation of the findings, the manufacturer acknowledged the flaws and stated that a patch was in the development pipeline. However, the correspondence between the two parties quickly deteriorated. OnePlus asserted that it maintained the "exclusive final right" to disclose vulnerabilities and explicitly warned the researcher that publishing any findings—even after a fix was developed—would be considered a legal liability.

The company further argued that European cybersecurity regulations mandate that manufacturers be given the opportunity to fix reports before disclosure, suggesting that unilateral publication by researchers falls outside the scope of acceptable practice. Despite these threats of legal action, and in the absence of a released software update, Moorats proceeded with a full technical disclosure on September 24, 2026. As of that date, OnePlus had not assigned a Common Vulnerabilities and Exposures (CVE) identifier to the flaws, nor had it issued an advisory to its user base regarding the potential for root-level compromise.

Industry Implications and Broader Security Trends

This incident is not an isolated event but rather part of a broader trend of "OEMpocalypse" scenarios, where custom software added by original equipment manufacturers (OEMs) introduces vulnerabilities that are absent in stock Android. In August 2026, security firm Calif highlighted a similar, widespread issue where code added by major manufacturers—including Samsung, Xiaomi, and Realme—allowed non-privileged apps to achieve root access.

The prevalence of these flaws suggests that the testing protocols for proprietary manufacturer software are failing to keep pace with the complexity of modern mobile operating systems. When manufacturers add "value-added" services for debugging or hardware management, they often inadvertently expand the attack surface of the device. Because these services run with elevated system permissions, any bug in their implementation becomes a potential gateway for total system compromise.

Furthermore, the lack of timely communication from companies like OnePlus poses a significant challenge to the security community. When researchers discover vulnerabilities, the window of time between discovery and patching is critical. By attempting to restrict disclosure, manufacturers risk leaving users exposed to "zero-day" exploits that could be discovered by malicious actors in the interim. The history of this specific manufacturer suggests a pattern of delayed response; for instance, a 2025 incident involving a telephony provider flaw went unaddressed until the researcher involved forced the issue by going public.

Recommendations for Device Owners

Until OnePlus provides a firmware update that addresses the AtlasService and olc2 vulnerabilities, there is no direct "patch" that users can apply. The vulnerability is inherent to the OS build, meaning that standard security settings cannot mitigate the risk if a malicious app is installed.

Security professionals advise the following precautionary measures:

• Restrict App Sources: The most effective defense against this specific attack vector is to avoid installing applications from untrusted sources. Stick strictly to the official Google Play Store, and exercise extreme caution with sideloaded APKs or third-party app stores.
• Monitor App Permissions: While this particular exploit does not require special permissions to function, maintaining a clean device by uninstalling unused or suspicious applications remains a best practice.
• Software Updates: Users should regularly check the "System Update" section in their device settings. Once OnePlus releases the patch for this vulnerability, it is imperative to install it immediately.
• Enterprise Awareness: For organizations managing fleets of OnePlus devices, these vulnerabilities present a significant threat to data privacy. IT administrators should consider enforcing strict app allow-lists via Mobile Device Management (MDM) solutions until a verified security patch is confirmed.

Conclusion

The case of the OnePlus root-access vulnerability serves as a stark reminder of the complexities inherent in the mobile security ecosystem. While the manufacturer has expressed a commitment to fixing the identified flaws, the confrontation over disclosure protocols underscores a fundamental disagreement regarding the responsibility of corporations toward their users. As mobile devices become increasingly central to both personal and professional lives, the ability to rapidly identify, acknowledge, and patch critical vulnerabilities is no longer just a technical necessity—it is a baseline requirement for consumer trust.

As of the current writing, the security community continues to monitor the situation for any signs of active exploitation in the wild. While there is no evidence that these flaws have been leveraged by threat actors to date, the public availability of the exploit methodology significantly increases the risk for any device running the affected versions of OxygenOS. The onus now rests with the manufacturer to demonstrate transparency and to expedite the deployment of a robust security fix to protect its global user base.