Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions

Security researcher Rasmus Moorats has disclosed a chain of two OxygenOS flaws that let any app already installed on a OnePlus device escalate to full root access without requesting any permissions or showing the user a prompt. The first bug abuses OnePlus's AtlasService, a root-running debugging component that executes unvalidated input from any caller, giving limited root inside a restricted sandbox zone. The second bug, in a hardware-helper service called olc2, accepts arbitrary shell commands from any process already running as root and executes them with full system-level Linux privileges, completing the takeover. Moorats confirmed the chain works on an unmodified OnePlus 15 and OnePlus 12 Pro, and expects it to affect OxygenOS 16 broadly; OnePlus told him the same code also impacts other OnePlus and OPPO devices, which share underlying software, but did not specify which models. OnePlus acknowledged both issues back in May but has not assigned a CVE or shipped a fix, and it warned Moorats that publishing details without its consent could expose him to legal liability — a threat he disclosed anyway on September 24 after months of stalled communication. There is no evidence the bugs have been exploited in real attacks, and since the flaw requires a malicious app to already be installed, the only current mitigation is sticking to trusted app sources until a patch arrives.