Security researcher **Rasmus Moorats** has unveiled a critical root exploit affecting **OnePlus** devices running the latest **OxygenOS**, and potentially many **OPPO** smartphones. The exploit leverages two distinct flaws in **OnePlus**'s proprietary software, enabling an installed malicious application to achieve the highest level of control over an Android phone without requiring any special permissions from the user. **OnePlus** confirmed both vulnerabilities in May but reportedly asserted its exclusive right to control disclosure, threatening legal action should **Moorats** publish without their consent. Despite these warnings and the absence of a public fix, **Moorats** proceeded with disclosure on September 24. ## The Disclosure Timeline and Corporate Response The disclosure process spanned approximately five months: * **April 18, 2026:** **Moorats** reported both flaws to **OnePlus**. * **May 20:** **OnePlus** confirmed the vulnerabilities, claimed sole control over disclosure, and issued a warning about potential legal liabilities if **Moorats** published. * **June 22:** **OnePlus** provided an update on their fix schedule and requested a delay in publication, which **Moorats** agreed to, setting a new deadline of September 17. * **July 20 and September 11:** **Moorats** requested updates but received no response. * **September 24:** With no fix released and no further communication, **Moorats** published his findings. **OnePlus**'s communication, which **Moorats** published in full, stated that while European cybersecurity rules mandate manufacturers accept and fix reports, they do not permit researchers to disclose without the manufacturer's consent. The company warned of pursuing "relevant legal liabilities in accordance with applicable laws" if **Moorats** published without permission. ## How the Attack Works **Moorats**'s exploit chains two distinct vulnerabilities: 1. **AtlasService Flaw:** The first flaw resides in **OnePlus**'s **AtlasService**, a debugging data collection service that runs with root privileges. This service accepts calls from any application without authentication. A specially crafted call can reach a **OnePlus** debugging tool that processes the app's text input and injects it, unchecked, into a system command. This grants the malicious app root access, but initially only within a restricted system zone known as `dumpstate`. 2. **olc2 Privilege Escalation:** The second flaw completes the attack. **OnePlus** devices ship with another service, a hardware helper named `olc2`, which includes a command capable of executing any shell instruction it receives. The only safeguard is that the caller must already possess root privileges – a condition met by the first flaw. This second stage executes the command in a zone that grants full low-level Linux privileges, including the ability to load kernel code, effectively giving the malicious app complete system-level control over the device. ## Who Is Affected and Mitigation Steps The attack is local, meaning a malicious app must first be installed and running on the phone. It cannot be launched remotely over the internet. Crucially, once installed, the app requires no special permissions and presents no prompts to the user. **Moorats** successfully demonstrated the attack on a stock **OnePlus 15** and an older **OnePlus 12 Pro**, expecting the issue to be widespread across **OxygenOS 16** and potentially **OPPO** devices, given their shared software foundations. As of **Moorats**'s disclosure, no **CVE** identifier had been assigned, and no official fix or advisory from **OnePlus** was available. While there is no evidence of these flaws being exploited in the wild, the only practical defense until a patch is released is to exercise extreme caution when installing applications, sourcing them only from trusted origins. ## Broader Context: Android Root Exploits This incident is not an isolated case of installed apps gaining root access on flagship Android phones. In August, **Lukas Maar**, a researcher at security firm **Calif**, demonstrated a different technique, dubbed **"OEMpocalypse,"** that allowed a no-permission app to gain root on locked phones from **Samsung**, **Xiaomi**, **OPPO**, **OnePlus**, and **Realme**. This method exploited code added by the manufacturers to the Android operating system. **OnePlus** has also faced criticism for slow responses to researchers in the past. In 2025, **Rapid7** reported a separate **OxygenOS** flaw that allowed any app to read a user's text messages, noting that **OnePlus** did not respond until the research was made public.