OxygenOS 16 flaws let apps gain root access on OnePlus and Oppo phones

A malicious app installed on a OnePlus phone could gain root access without asking for a single permission. Security researcher Rasmus Moorats found two flaws in OxygenOS that let an app break out of Android’s sandbox and take control of parts of the phone it should never be able to reach. OnePlus confirmed to him that the flaws affect multiple OnePlus and Oppo devices across different software versions, but it has not provided a complete list.

Moorats developed the exploit on an older OnePlus 12 Pro that he had already unlocked and rooted for research. He then installed the same unmodified app on his OnePlus 15 running OxygenOS 16.0.3.503. That phone had not been rooted or modified, and the exploit worked on the first attempt. Someone would need to install and open the malicious app for the attack to work, but the app would not need to request any permissions.

The attack uses the two flaws in sequence. The first is in AtlasService, a background service that collects diagnostic and debugging information. It runs with root privileges but does not check which app is sending it a request. Moorats found that an app could make an audio debugging tool treat part of that request as a command and run it as root. Android still limits what the resulting process can do, so the attack then turns to another OnePlus component called olc2. This service can run shell commands and checks only whether a request comes from a root process. The process created through AtlasService passes that check, allowing it to run commands with much broader control over the phone.

The exploit worked on phones using different kernel versions, leading Moorats to suspect the flaws may extend across OxygenOS 16. He first reported them to OnePlus on April 18 and followed up after receiving no reply. The company confirmed the flaws in a May 20 email and said fixes had been scheduled. In the same response, OnePlus claimed it alone could decide whether technical details were published, even after patches were released. It also argued that European cybersecurity rules did not allow publication without its consent and warned of legal action if he went ahead.

OnePlus later asked for more time to prepare the fixes, and Moorats agreed not to publish before September 17. Despite that extension, his requests for updates in July and September went unanswered. He published his findings on September 24, more than five months after his initial report. The write-up explains how the flaws work together and includes code excerpts from the test app. He has since verified that OxygenOS 16.0.10.500(EX01) fixes both flaws on the OnePlus 15.