Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions
-
A researcher has demonstrated that a OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, without that app requesting any special permissions. According to the report, researcher Rasmus Moorats chained two flaws in OnePlus's own software to obtain root access, which is the highest level of control over an Android device.
The concerning part is the scope. OnePlus reportedly told the researcher that the same flaws affect many more of its own devices as well as devices from OPPO — though it has not yet been confirmed whether a fix has been released.
Key points:
- Attack vector is a locally installed app requiring no special permissions
- Two flaws were chained together to achieve root
- Affected hardware reportedly extends beyond the OnePlus 15 to other OnePlus and OPPO devices
- No patch details were provided at the time of reporting
If you use a OnePlus or OPPO device, it is worth watching for official updates and being cautious about sideloaded applications until the vendor ships a fix.
Source: The Hacker News
Does your organization manage OnePlus or OPPO devices, and if so, how are you handling the lack of a patch so far?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login