Two Chained OnePlus/OxygenOS Flaws Reportedly Let Installed Apps Gain Root Silently

What happened

Researcher Rasmus Moorats reportedly chained two vulnerabilities in OnePlus's own OxygenOS software to gain root access on a OnePlus 15 running the latest OxygenOS build, according to a report from The Hacker News. Critically, the attack path is described as achievable by a malicious app that the device owner installs themselves — one that requests no special or unusual Android permissions. OnePlus reportedly told the researcher that the same underlying flaws affect a broader range of its own devices as well as OPPO devices, though as of the report, no patch had been issued.

Why it matters

Root access is the highest privilege tier on Android, effectively giving an attacker full control over the device — bypassing the app sandboxing and permission model that most mobile security assumptions rely on. If confirmed at the scale OnePlus reportedly indicated (spanning multiple OnePlus and OPPO models), this could affect a large population of consumer and possibly enterprise-carried Android devices. Because no elevated permissions are required at install time, standard permission-review habits and MDM permission policies would not surface this as suspicious — a seemingly benign app could be the entire attack chain.

What defenders should watch for

• Track vendor advisories from OnePlus and OPPO for a patch or security bulletin addressing this root-escalation chain, and prioritize OxygenOS/ColorOS updates once available.
• For managed Android fleets, review EMM/MDM policies for unexpected root/superuser indicators (e.g., SafetyNet/Play Integrity attestation failures, unexpected su binaries, or unusual system partition writes) rather than relying solely on requested-permission review.
• Restrict sideloading and unknown app installs where possible, since the reported vector requires the user to install an app — even one requesting minimal permissions.
• Watch threat intel and app-store telemetry for apps exhibiting anomalous privilege-escalation behavior post-install, particularly on affected OnePlus/OPPO hardware.

Developing story

Details here — including the specific vulnerable components, full device list, and any available patch timeline — are still emerging and based on a single researcher's disclosure as reported by the source. This item is not tied to a formal CVE assignment at time of writing. For the original reporting, see The Hacker News.