OnePlus Android Root Flaw Enables Unprivileged Apps to Gain Full Root
On September 24, 2026 security researcher Rasmus Moorats disclosed a chain of two local-privilege-escalation bugs in OnePlus' OxygenOS that constitutes a classic OnePlus Android root flaw. The chain lets any installed Android app obtain full root without requesting permissions, and the vulnerabilities remain unpatched as of this writing.
Technical Chain Overview
The first bug resides in AtlasService, a debugging daemon that runs as root and accepts IPC calls from any application without authenticating the caller. Moorats showed that a crafted request causes AtlasService to write attacker-supplied text directly into a system command executed by the dumpstate sandbox. Although dumpstate isolates the command, it runs with elevated privileges, granting the attacker a limited root context.
The second bug is in olc2, a hardware-helper service shipped with OxygenOS. Olc2 executes any shell instruction it receives, but it only accepts commands from callers that already have root. By first compromising AtlasService, the attacker satisfies this precondition, allowing olc2 to run the supplied command with unrestricted Linux privileges, including kernel-module loading. The result is full system-level control.
Affected Products and Versions
- OnePlus 15 running OxygenOS 16 (tested by Moorats).\n- OnePlus 12 Pro – the same chain works on this older flagship.\n- Any device that shares the OnePlus-derived code base, including certain OPPO models, is presumed vulnerable because the services are common across the brands.
OnePlus confirmed the existence of both flaws in May 2026 but asserted exclusive disclosure rights and warned of legal action if details were published without consent. No public advisory or CVE identifier has been assigned.
Real-World Likelihood and Pre-conditions
The exploit is local: an attacker must first convince the user to install a malicious application. The malicious app does not request any Android permissions, displays no prompts, and can operate on a stock device with no prior modifications. Because the attack requires code execution on the device, it cannot be delivered over the network alone.
There is currently no evidence of active exploitation in the wild. However, the technique mirrors a separate August 2026 discovery by researcher Lukas Maar, who achieved similar root on locked Samsung, Xiaomi, OPPO, OnePlus, and Realme devices by abusing vendor-added code. That independent report, published by the Google Project Zero blog, underscores a systemic issue in how manufacturers extend Android's trusted computing base (see Android).
Mitigation Guidance Until a Patch Arrives
- Restrict app sources – only install applications from the Google Play Store or other vetted repositories. The exploit cannot run without a malicious APK present on the device.\n2. Monitor for updates – OnePlus has indicated a fix is in development. Apply the next OTA update as soon as it becomes available.\n3. Enterprise device management – enforce policies that block side-loading of APKs and enable Play Protect or equivalent runtime scanning.\n4. Threat-intel feeds – watch for indicators of compromise (IOCs) related to the AtlasService and olc2 call patterns, which may appear in future malware analyses.
Disclosure Timeline and Legal Tension
| Date | Event |
|---|---|
| 2026-04-18 | Moorats reports both flaws to OnePlus. |
| 2026-05-20 | OnePlus acknowledges the bugs, claims exclusive disclosure rights, and warns of legal liability. |
| 2026-06-22 | OnePlus provides a tentative fix schedule; researcher agrees to delay public release until September 17. |
| 2026-07-20 & 2026-09-11 | Follow-up requests for status receive no response. |
| 2026-09-24 | Moorats publishes full technical details despite OnePlus' objections. |
The episode highlights friction between coordinated vulnerability disclosure practices and vendor-imposed disclosure controls, a topic frequently discussed in the context of the EU’s Cybersecurity Act and the NIS2 Directive.
Broader Implications for Mobile Security
- Vendor-added services: Both AtlasService and olc2 are non-standard Android components introduced by OnePlus. Their insecure design illustrates the risk of expanding the trusted computing base without rigorous code review.\n- Regulatory pressure: European regulators may view OnePlus' refusal to assign a CVE and its legal threats as non-compliance with mandatory vulnerability handling obligations under NIS2.\n- Supply-chain awareness: Organizations that deploy OnePlus devices in BYOD or corporate fleets should reassess their risk posture and consider alternative hardware until a patch is confirmed.
What to Watch Next
- Patch release – OnePlus is expected to ship an OTA update in the coming weeks; security teams should verify the presence of the fix by checking the device’s build fingerprint.\n- Potential exploitation – Threat actors may weaponize the chain in targeted campaigns once a patch is public, especially against high-value individuals who frequently sideload apps.\n- Further research – The methodology could be adapted to other OEM-specific services; monitoring upcoming disclosures from security conferences will be critical.
For additional context on how similar vendor-specific bugs have been handled, see the analysis of the recent Cisco 0-Day vulnerability on our site (Thehackernews).
Related coverage
- Cisco 0-Day Vulnerability Exposes Users to Remote Exploitation
- Google Gemini AI Model Breach: A Case Study
- Threat Actors Exploit AI Chatbot Security Vulnerabilities for Mass Disinformation and Phishing Campaigns