Security researcher Rasmus Moorits identified two vulnerabilities in OnePlus system software that grant root access to Android applications. The exploit functions without requiring any special user permissions.
The first flaw resides in the AtlasService component of OxygenOS, allowing execution of commands with root privileges. The second vulnerability in the OplusLogCore service enables bypassing SELinux security mechanisms, completing the privilege escalation chain.
Moorits tested the exploit on OnePlus 12 and OnePlus 15 devices using a standard APK. The attack succeeded on both models, confirming that multiple generations of hardware and software versions are affected.
OnePlus acknowledged the security issues in May after being notified in April. The company confirmed that the vulnerabilities impact various OnePlus and Oppo smartphone models, though a full list of affected devices remains undisclosed.
A fix for these vulnerabilities was included in OxygenOS version 16.0.10.500(EX01) for the OnePlus 15, which began rolling out in August. It is currently unclear if all other vulnerable Oppo and OnePlus devices have received similar patches.
