<![CDATA[Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions]]>A researcher has demonstrated that a OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, without that app requesting any special permissions. According to the report, researcher Rasmus Moorats chained two flaws in OnePlus's own software to obtain root access, which is the highest level of control over an Android device.

The concerning part is the scope. OnePlus reportedly told the researcher that the same flaws affect many more of its own devices as well as devices from OPPO — though it has not yet been confirmed whether a fix has been released.

Key points:

  • Attack vector is a locally installed app requiring no special permissions
  • Two flaws were chained together to achieve root
  • Affected hardware reportedly extends beyond the OnePlus 15 to other OnePlus and OPPO devices
  • No patch details were provided at the time of reporting

If you use a OnePlus or OPPO device, it is worth watching for official updates and being cautious about sideloaded applications until the vendor ships a fix.

Source: The Hacker News

Does your organization manage OnePlus or OPPO devices, and if so, how are you handling the lack of a patch so far?

]]>https://xploitlk.com/topic/455/unpatched-oneplus-flaws-let-installed-android-apps-gain-root-without-permissionsRSS for NodeTue, 27 Oct 2026 10:35:42 GMTFri, 25 Sep 2026 00:30:21 GMT60