OnePlus Faces Scrutiny After Security Researcher Publicly Discloses Unpatched Root-Level Flaws in OxygenOS

A security researcher has publicly disclosed a severe vulnerability chain affecting modern OnePlus and OPPO smartphones running the latest iteration of OxygenOS. The exploit allows a locally installed, unprivileged application—requiring zero special user permissions—to achieve full root-level control over a targeted device. Despite confirming the security gaps nearly half a year prior, the manufacturer failed to release a patch before the researcher went public, sparking a contentious debate over vulnerability disclosure ethics, corporate legal threats, and systemic security challenges across the Android original equipment manufacturer (OEM) ecosystem.

Independent security researcher Rasmus Moorats detailed the vulnerability chain in a late-September publication, demonstrating how a combination of two distinct software flaws in OnePlus’s custom software layer could be weaponized. According to Moorats, testing on a stock OnePlus 15 device revealed that a malicious app could seamlessly escalate its privileges from standard app-level isolation all the way to unrestricted system command execution. Furthermore, communication between Moorats and OnePlus confirmed that the underlying software vulnerabilities extend far beyond a single model, impacting a broader range of hardware manufactured by both OnePlus and its sister company, OPPO, which share foundational software architecture.

The disclosure timeline reveals a tense standoff between the independent researcher and the hardware manufacturer. OnePlus officially acknowledged both security flaws in May, confirming their existence in its software stack. However, rather than partnering on a swift collaborative patch release, the company reportedly asserted strict ownership over the vulnerability lifecycle. In email correspondence published in full by Moorats, OnePlus maintained that it holds the exclusive final right of vulnerability disclosure. The company warned the researcher that publishing any technical details without explicit corporate consent—even after an eventual patch is deployed—could expose him to legal liability under European cybersecurity regulations, which dictate corporate reporting obligations while restricting independent public disclosures without maker approval.

Despite explicit legal warnings and the absence of a publicly available firmware patch or Common Vulnerabilities and Exposures (CVE) identifier at the time, Moorats proceeded with public disclosure on September 24. The released findings expose deep-seated architectural security risks inherent in how custom Android user interfaces handle background diagnostic services and hardware helper utilities.

How the Attack Works

The attack vector mapped out by Moorats relies on chaining two separate components within the OxygenOS framework. The first vulnerability resides in a background service called AtlasService. Designed to gather debugging data, AtlasService operates with root privileges by default. Critically, the service lacks proper access control checks, meaning it accepts and processes inter-process communication calls from any locally installed application running on the device, regardless of whether that app possesses elevated permissions.

To exploit this, an unprivileged malicious application sends a crafted call to the AtlasService. This call interacts with a OnePlus debugging tool that improperly sanitizes input, taking text supplied by the application and directly injecting it into a system command without validation. While this initial injection successfully hands the application root privileges, the access is initially constrained to a restricted system zone known as dumpstate, which limits the scope of what the compromised process can achieve compared to full Linux root access.

To bypass these limitations, the exploit chains a second vulnerability. OnePlus includes a hardware helper service designated as olc2, which features a command execution capability designed to run arbitrary shell instructions. The sole security guard protecting the olc2 service is a prerequisite that any calling process must already possess root privileges—a condition that the first flaw satisfies. By leveraging the initial entry point to reach the olc2 service, the malicious application escapes the restricted dumpstate zone and executes commands with full low-level Linux privileges. This grants the attacker the ability to load custom kernel code and seize total system-level control of the device.

Who Is Affected, and What You Can Do

Because the exploit chain requires a malicious application to be present and executing on the physical device, it cannot be executed remotely over the internet. Nevertheless, the attack presents significant risks due to its stealth and efficacy. The exploit requires no special permissions to execute, displays no warning prompts to the device owner, and functions seamlessly on unmodified, factory-stock operating system builds.

Beyond the flagship OnePlus 15, Moorats confirmed that the exploit successfully compromises older hardware models, such as the OnePlus 12 Pro. Given the shared codebase between OnePlus and OPPO devices running OxygenOS and ColorOS, experts anticipate that the vulnerability footprint spans a wide array of devices operating on recent software iterations.

At the time of the public disclosure, OnePlus had not issued a formal security advisory, assigned a CVE identifier, or distributed an operating system patch to remediate the flaws. In the absence of an official software update, security professionals emphasize that standard defensive hygiene remains the primary safeguard. Because the attack vector relies entirely on an installed application initiating the exploit chain, users are strongly advised to exercise caution, avoid downloading unverified software packages, and restrict application installations exclusively to trusted sources.

The incident highlights a broader, ongoing industry challenge regarding the security posture of custom Android implementations. The disclosure follows a pattern of heightened scrutiny directed at OEM-specific software layers. Earlier in the year, independent researchers demonstrated alternative techniques allowing unprivileged applications to compromise locked flagship devices across multiple major manufacturers—including Samsung, Xiaomi, OPPO, OnePlus, and Realme—by exploiting proprietary code layered on top of Android. Furthermore, previous security incidents involving OnePlus, such as a 2025 telephony provider permission bypass reported by Rapid7 that allowed arbitrary text message reading, have drawn criticism for delayed manufacturer responsiveness and communication hurdles. As mobile security research continues to probe the depths of custom OEM frameworks, incidents like this underscore the mounting tension between independent vulnerability disclosure and corporate compliance frameworks.