A security researcher has shown that a malicious Android app can gain root control of a recent OnePlus phone without asking for any permissions. Rasmus Moorats chained two vulnerabilities in OnePlus's own software on a stock OnePlus 15 running the latest OxygenOS. The first flaw sits in AtlasService, a debugging service that runs as root and accepts calls from any app; it lets the app inject text into a system command within a restricted zone called dumpstate. The second flaw, in a hardware helper named olc2, executes arbitrary shell instructions for any caller already running as root—which the first flaw provides—resulting in full low-level Linux privileges, including kernel code loading.
Moorats also reproduced the attack on an older OnePlus 12 Pro and expects the problem to affect OxygenOS 16 in general. OnePlus told him the same flaws affect more of its own devices and those of OPPO, though it did not specify which. There is no evidence the flaws have been exploited in the wild. The attack is local: a malicious app must be installed and running on the device first, so it cannot be triggered remotely.
OnePlus confirmed both flaws in May 2026 but released no fix. In its reply to Moorats, the company claimed sole control over when to disclose vulnerabilities and warned that publishing without its permission could lead to legal liability. It also said researchers may not publish full technical details even after a fix ships. Moorats published on September 24 after waiting about five months, with no CVE assigned and no advisory available. Until a fix arrives, the practical defense is to install apps only from trusted sources.