A malicious app installed on a OnePlus 15 running the latest OxygenOS can gain root access — the deepest level of control over an Android device — without requesting any special permissions from the user, according to security researcher Rasmus Moorats, who disclosed the vulnerability on September 24. Moorats linked together two separate flaws in OnePlus's proprietary software to achieve root privileges, and OnePlus confirmed in May that the same vulnerabilities affect many additional OnePlus and OPPO devices, though the company has not identified which models are at risk.

The exploit chains two security gaps in OnePlus services. The first flaw exists in AtlasService, a OnePlus debugging tool that operates with root privileges and accepts requests from any application without verifying the caller's identity. A specially crafted request can reach a debugging function that inserts the app's text directly into a system command without validation, granting root access within a restricted environment called dumpstate. The second vulnerability involves olc2, a hardware service that executes any shell instruction it receives, protected only by a requirement that the caller already possess root access — which the first flaw provides. This second command runs in an environment with full low-level Linux capabilities, including the power to load kernel code, giving the application complete system-level control. Moorats confirmed the attack works on both the OnePlus 15 and the older OnePlus 12 Pro, and expects it to succeed across OxygenOS 16 generally. The attack is local, meaning a malicious application must first be installed and running on the device, but once present it requires no user permissions and displays no prompts to the owner.

Moorats reported both flaws to OnePlus on April 18, 2026. OnePlus confirmed the vulnerabilities on May 20 but also asserted "the exclusive final right of vulnerability disclosure" and warned that publishing without the company's consent could result in legal liability. In the same message, which Moorats published in full, OnePlus stated that even after a fix is released, researchers may not share complete technical details independently. The company argued that European cybersecurity regulations require manufacturers to receive and remediate vulnerability reports but do not permit researchers to disclose them without the maker's approval. Moorats agreed to delay publication until September 17, but when OnePlus failed to respond to follow-up requests on July 20 and September 11, he published on September 24 with no fix available and no CVE assigned.

The practical defense until a patch arrives is the same element the attack requires to begin: install applications only from trusted sources, since the exploit cannot execute without a malicious app already present on the phone. Moorats found no evidence the vulnerabilities have been exploited in actual attacks. This is not an isolated incident for OnePlus or for Android manufacturers more broadly. In August, researcher Lukas Maar at security firm Calif demonstrated a separate technique that allowed a no-permission app to root locked devices running the newest firmware from Samsung, Xiaomi, OPPO, OnePlus, and Realme by targeting code the manufacturers add to Android. In 2025, Rapid7 disclosed a different OxygenOS flaw permitting any app to read a user's text messages and reported that OnePlus did not respond until after the research became public. The legal threat OnePlus issued raises questions about how manufacturers balance coordinated disclosure with researcher freedom, especially when fixes remain unavailable months after confirmation. For organizations relying on mobile devices, the absence of a patch or official advisory underscores the tension between waiting for vendor action and managing immediate risk through policy controls like app installation restrictions.