A security researcher has demonstrated a way to gain full root access to a OnePlus 15 running the latest OxygenOS by installing a malicious app that does not require any special permissions.
The attack was developed by researcher Rasmus Moorats, who chained two vulnerabilities in OnePlus system software to move from an ordinary app to root-level control of the device. Root access provides extremely powerful control over an Android phone, including access to areas normally protected from regular applications.
The vulnerabilities are not limited to the OnePlus 15. OnePlus told Moorats that the same issues affect additional OnePlus and OPPO devices, although the company has not publicly identified the full list of affected models.
According to Moorats, he reported both vulnerabilities to OnePlus in April. The company confirmed the issues in May and said a fix was planned. However, OnePlus also told the researcher that it had exclusive control over when the vulnerabilities could be publicly disclosed and warned that publishing technical details without its approval could create legal consequences.
Moorats ultimately published his research on September 24 after the company had not released a patch.
The attack begins with AtlasService, a OnePlus system service that operates with root privileges and accepts requests from applications without properly verifying the caller. A specially crafted request can reach a debugging component that places application-controlled text into a system command.
That gives the malicious app root privileges within a restricted environment known as dumpstate. While this initial access does not provide unrestricted control of the entire phone, it is enough to move on to the second vulnerability.
The next step involves another OnePlus component called olc2, a hardware-related service capable of executing shell commands. Its protection assumes that the caller is already running as root, which the first vulnerability has already achieved.
By combining the two flaws, the attacker can execute commands in an environment with much broader Linux privileges. The researcher demonstrated that this level of access can include the ability to load kernel code, effectively giving the malicious application system-level control of the device.
The attack does require the malicious application to be installed on the phone first, meaning it cannot simply be launched remotely over the internet. However, the app does not need special Android permissions or require the user to approve a permission request once it is installed and running. Moorats also demonstrated the technique against an unmodified stock device.
The researcher confirmed the attack on an older OnePlus 12 Pro and said he expects the underlying issue to affect OxygenOS 16 more broadly. Because OnePlus and OPPO share parts of their software platforms, OnePlus’ own warning also extended to devices from both companies.
At the time of the disclosure, OnePlus had not assigned CVE identifiers to the vulnerabilities and had not released a public security advisory identifying them. No evidence has been presented showing that the flaws have been exploited in real-world attacks.
For users, the immediate protection is relatively straightforward: avoid installing applications from untrusted sources. Since the attack depends on a malicious application already being present on the device, preventing that installation blocks the attack chain from starting.
The disclosure followed months of communication between the researcher and OnePlus. Moorats said he reported the vulnerabilities on April 18. OnePlus confirmed them on May 20 and asked him not to disclose the details. The company provided another update in June, after which Moorats agreed not to publish before September 17. He later requested additional updates in July and September but said he received no response before publishing his findings on September 24.
The research comes amid other recent demonstrations showing how Android vendors’ custom software can introduce pathways to root access. In August, researcher Lukas Maar demonstrated a separate technique that could reportedly take a no-permission application to root access on locked devices from several major Android manufacturers, including OnePlus.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
OnePlus has also faced criticism over the handling of previous security reports. In 2025, Rapid7 disclosed an OxygenOS vulnerability that could allow an application to access users’ text messages and said the company did not respond until after the research became public.
