Unpatched OnePlus Vulnerabilities Enable Root Access via Malicious Installed Apps

A security researcher identified two flaws in OnePlus's OxygenOS software that, when chained together, allow a malicious application installed on the device to attain root access without requesting any special permissions. The researcher, Rasmus Moorats, successfully demonstrated the exploit on a OnePlus 15 running the latest OxygenOS.

OnePlus informed the researcher that the same vulnerabilities affect many more of its own devices and those of its sister brand, OPPO. As of the report date, OnePlus has not released security patches to address the flaws. The implications are significant, as a user-installed application with no elevated permission requests could achieve the highest level of control over the affected Android device, potentially leading to full compromise including data theft, installation of persistent malware, and modification of system functions.

The researcher chained two undisclosed flaws in OxygenOS to achieve root access. OnePlus has acknowledged the breadth of impact but has not provided a timeline for remediation. Users are advised to monitor official security advisories and apply updates when available.