Two flaws OnePlus confirmed in May still let a no-permission app root the OnePlus 15

The entry point is AtlasService, a OnePlus service that gathers debugging data and runs as root ^[4]. It accepts calls from any app and does not check who is calling ^[4]. A crafted call reaches a OnePlus debugging tool that drops the app's text, unchecked, into a system command ^[5]. The app then has root, but only inside dumpstate, a restricted system zone that cannot do everything root normally can ^[5].

The second bug lifts that limit. A hardware helper OnePlus ships, olc2, has a command that executes any shell instruction it receives ^[6]. Its only guard is that the caller must already be root, and the first bug provides that ^[6]. The instruction then runs in a zone that grants all low-level Linux privileges, including the ability to load kernel code ^[7].

The attacker's only hurdle is getting the app onto the phone ^[8]. Once it is running it needs no permissions and shows the owner no prompt, and Moorats's test phone was stock ^[8]. He also confirmed the chain on an older OnePlus 12 Pro and expects it to work across OxygenOS 16 generally ^[9]. OnePlus's scope warning covered OPPO because the two brands build their phones on shared software ^[17]. Until a fix ships, the practical defense is installing apps only from trusted sources ^[11].

Moorats reported both bugs on April 18 ^[1]. The May 20 confirmation said a fix was scheduled ^[2][20]. On June 22 OnePlus sent an update on the fix and asked him to hold off, and he agreed not to publish before September 17 ^[3]. His requests for updates on July 20 and September 11 got no reply ^[4]. He published on September 24, 159 days after his report and seven days past the date he had agreed to ^[5][1][3].

The legal position arrived in that same May 20 message, which Moorats has published in full ^[3][20]. In it, OnePlus claimed "the exclusive final right of vulnerability disclosure" ^[13]. Researchers, it said, may not publish full technical details on their own even after a fix ships ^[14]. If he went ahead without permission, the company warned, it would "pursue relevant legal liabilities in accordance with applicable laws" ^[16]. The Hacker News report describes the basis only as European cybersecurity rules and does not name a specific regulation ^[15].

Both bugs are in OnePlus's own software ^[1]. Maker-added code was also the target in August ^[18]. Lukas Maar of the security firm Calif used a different technique to take a no-permission app to root on locked phones from Samsung, Xiaomi, OPPO, OnePlus and Realme, all on their latest firmware ^[18]. In 2025, Rapid7 reported a separate OxygenOS flaw that let any app read a user's texts, and said OnePlus did not respond until the research was public ^[19].