As reported by The Hacker News, security researcher Rasmus Moorats disclosed a two-stage local privilege escalation chain affecting OnePlus and OPPO devices running OxygenOS — including the OnePlus 15 and OnePlus 12 Pro — that allows any installed app to achieve full root without requesting a single permission or triggering any user prompt.
What Makes This Chain Dangerous
Most Android privilege escalation bugs require some entry vector — a permission grant, a user interaction, or a system modification. This chain is notable because it works on a fully stock device and the attacking app appears completely innocuous to both the user and the Android permission model. The first flaw lives in AtlasService, a OnePlus system service running as root that accepts IPC calls without verifying the caller's identity. A crafted input reaches a debugging utility that passes attacker-controlled text unsanitized into a system command — a textbook command injection. The second flaw in the olc2 hardware helper service then takes that restricted-root foothold and escalates it to full system-level root, including kernel module loading capability.
The combination of zero-permission exploitation, no user prompt, and full root on stock devices makes this one of the more significant mobile local privilege escalation disclosures of 2026 — particularly for enterprise fleets where BYOD policies may underestimate local app risk.
Vulnerability Details
| Field | Details |
|---|---|
| CVE Identifiers | Not publicly assigned as of disclosure date |
| Severity | High to Critical (local root without permissions) |
| Affected Products | OnePlus 15, OnePlus 12 Pro (confirmed); broader OnePlus and OPPO devices running OxygenOS / ColorOS shared software base |
| Affected Versions | OxygenOS 16 and likely earlier versions; exact version range not disclosed by vendor |
| Vulnerable Components | AtlasService (caller authentication bypass + command injection); olc2 (unrestricted shell execution as root) |
| Patch Status | No patch available as of September 24, 2026 — OnePlus confirmed flaws in May 2026 but has not released a fix |
| Active Exploitation | None publicly observed |
| Attack Vector | Local — requires malicious app installed on device; no network component |
The Disclosure Dispute That Matters to Everyone
Beyond the technical severity, this story highlights a growing and deeply problematic pattern: vendors asserting that researchers cannot publish vulnerability details without corporate consent. OnePlus reportedly told Moorats it holds “the exclusive final right of vulnerability disclosure” and threatened legal liability if he published. This framing misrepresents the regulatory landscape. The EU's vulnerability disclosure regulations — including those under the Cyber Resilience Act and NIS2 — are designed to protect researchers who act in good faith, not to grant vendors veto power over independent disclosure.
When vendors delay patches for months while simultaneously threatening the people who reported the flaws, they create exactly the conditions that benefit malicious actors: vulnerabilities remain unpatched, defenders remain uninformed, and the only party with full knowledge of the risk is the one least incentivized to act quickly.
Shield53 Recommendations
Immediate Actions
Broader Guidance
- Reassess your mobile threat model: local privilege escalation without permissions fundamentally undermines Android's permission-based security model on affected devices. If root is achievable silently, assume that any installed app on a OnePlus/OPPO device could potentially have full system access.
- For regulated environments (financial services, government, healthcare), consider whether OnePlus/OPPO devices should remain on approved device lists until a patch and CVE assignment are confirmed.
- Support independent disclosure: organizations should publicly back coordinated vulnerability disclosure frameworks that protect researchers. Vendor attempts to suppress disclosure harm the entire defensive community.
This chain is a reminder that OEM-added system services are a frequent and underappreciated attack surface on Android. Every custom service running as root is a potential injection point — and when vendors delay fixes for months while silencing researchers, the risk compounds for everyone relying on those devices.
