OnePlus Leaves Flaws Unpatched as Ordinary Apps Reach Root Without Permissions

Security researcher Rasmus Moorats has shown that a OnePlus 15 running the latest OxygenOS can be taken over by a malicious app the owner installs. The app asks for no special permissions, yet it can still gain root, the highest level of control over the phone.

How the attack works

The chain relies on two flaws in OnePlus's own software. The first lives in a service called AtlasService, which gathers debugging data, runs as root, and accepts calls from any app without checking who is calling. A crafted call reaches a OnePlus debugging tool that drops the app's text, unchecked, into a system command. That grants root, but only inside a restricted zone called dumpstate, where much is still off limits.

The second flaw finishes the job. The firmware also ships a hardware helper called olc2 with a command that executes any shell instruction it receives. Its only guard is that the caller must already be root — exactly what the first flaw provides. This time the command runs in a zone that grants all low-level Linux privileges, including the ability to load kernel code, handing the app control of the device at the system level.

Who is affected

The attack is local: a malicious app has to be installed and running first, so it cannot be triggered over the internet. But once present, the app needs no permissions and shows the user no prompt — and it worked on a stock, unmodified phone. There is no evidence anyone has exploited the flaws in the wild.

Moorats also confirmed the attack on an older OnePlus 12 Pro and expects the problem to extend across OxygenOS 16 in general. OnePlus told him the same flaws affect many of its own devices and OPPO handsets built on shared software, but did not say which ones.

A dispute over disclosure

OnePlus confirmed both flaws back in May, but in the same reply claimed the sole right to decide on disclosure and warned of "legal liability" for publishing without consent. The company argued that European cybersecurity rules require makers to accept and fix reports but do not allow researchers to disclose them without the vendor's approval.

The exchange dragged on for roughly five months. In June OnePlus asked him to hold off, and Moorats agreed not to publish before September 17. Requests for updates in July and September went unanswered. On September 24 he published anyway — with no patch out, no CVE assigned, and no OnePlus advisory to be found.

Until a fix ships, the one practical defense is the very thing the attack needs to get started: install apps only from sources you trust.

Source: The Hacker News