Two serious Android vulnerabilities have been discovered in OnePlus devices that could allow a malicious app—installed without any special permissions—to gain root access and take full control of a device. The flaws, identified by researcher Rasmus Moorats, are unpatched as of late September 2026, leaving users exposed.
What the Flaws Are
The first issue lies in OnePlus’s “AtlasService,” a diagnostic service meant to gather debugging information. This service runs with root privileges and accepts requests from any app, without verifying the caller’s identity. By crafting a request to a debugging tool built into AtlasService, a malicious app can supply arbitrary text that gets injected into a system command. That gives the app root access—but only within a limited context known as “dumpstate,” which imposes certain restrictions.
The second flaw builds on the first. OnePlus includes another system service called “olc2,” a hardware helper that accepts shell commands from any process already holding root privileges. While this service doesn’t impose further checks if it’s contacted by something rooted, it grants full low-level Linux permissions when executing commands—including loading kernel modules—effectively giving the attacker system-level control of the device.
Scope, Timeline, and What’s Being Done
These issues are local only: a malicious app must be installed on the device in order to exploit them. The app needs no special permissions and triggers no permission prompts, and they reportedly work on stock, unmodified OnePlus phones. The flaws have been confirmed on a newer OnePlus 15 model and older devices like the OnePlus 12 Pro. OnePlus and OPPO, which share large parts of their software stack, are believed to be affected broadly wherever OxygenOS 16 is used. So far, no public exploits are known to have made it into real-world attacks.
Moorats first reported the flaws in April 2026. OnePlus acknowledged them in May, but asserted the sole right to manage their disclosure and warned of legal implications if details were published without consent. Over the following months, updates and communication were slim and noncommittal. As of this week, no fix has been released, no CVE identifiers have been assigned, and no public advisory has gone live.
What Users Can Do
Since there’s currently no patch, users should be very selective about what apps they install. Only load apps from trusted sources, and avoid installing unknown or peer-shared APKs. Scrutinize apps carefully and resist sideloading. Until OnePlus issues a software update or an official fix, avoiding untrusted apps is the only practical defense.
OnePlus has stated that a fix is planned. It also claims that existing European cybersecurity laws oblige vendors to accept and remediate vulnerability reports—but do not permit researchers to publish technical details without the vendor’s consent. The company warned of possible legal action if a researcher publicizes findings independently. Despite that, Moorats published his findings on September 24, 2026, after no fix had been made available.
Why this matters: Root access emerges as the ultimate privilege on Android devices; flaws that allow any app—without explicit permissions—to gain it are extremely dangerous. They pose serious risks to privacy, security, and system integrity. We’re now watching whether OnePlus and OPPO follow through with a prompt fix, whether CVEs are assigned, and how legal pressures around vulnerability disclosure will evolve. Mobile users, especially those using OxygenOS 16, should keep their guard up: the threat is real until confirmed patched.
