Researcher Rasmus Moorats disclosed two chained vulnerabilities in OnePlus software on September 24, 2026, that allow a malicious Android app to gain root access on affected devices without requiring any special permissions. The flaws affect the OnePlus 15 running the latest OxygenOS and, according to OnePlus, also impact many other OnePlus and OPPO devices. OnePlus acknowledged the vulnerabilities but has not released patches as of the disclosure date.
How the OnePlus Vulnerability Chain Escalates from App to Root Access
Moorats chained two separate flaws in OnePlus software to achieve privilege escalation from a standard Android app to root—the highest level of system control. The specific technical details of the vulnerabilities were not disclosed, but the chain enables an installed app to bypass Android’s permission model and gain superuser privileges without the user approving dangerous permissions or granting explicit root access.
This capability turns any malicious app that reaches a OnePlus device into a potential rooting toolkit. Unlike traditional Android rooting, which requires deliberate user action and typically involves unlocking the bootloader or installing custom recovery software, the OnePlus flaws allow silent privilege escalation after an app is installed through normal means—downloaded from the Play Store, sideloaded, or delivered via phishing.
Root Privilege Implications: Complete Device Control and Persistence
Root access on Android grants complete control over the operating system, file system, and hardware. A malicious app with root can disable security features, hide its presence from antivirus tools, modify system binaries, intercept all network traffic including encrypted communications, and persist across factory resets by embedding itself in protected system partitions.
The OnePlus vulnerability chain removes the primary barrier preventing malware from achieving this level of control: the Android permission model. Normally, apps that want dangerous permissions must request them explicitly, and users see permission prompts before granting access to sensitive capabilities. By escalating to root without triggering permission prompts, the flaws let malware operate with full privileges while appearing to the user as a low-risk application that requested only benign permissions like internet access.
OnePlus Confirms Broad Device Impact Across OnePlus and OPPO Lines
OnePlus confirmed the vulnerabilities affect “many more of its own devices and those of OPPO,” the related smartphone manufacturer that shares software components with OnePlus. The confirmation indicates the flaws are not limited to a single device model or OxygenOS version but instead exist in shared code used across the product lines.
This broad impact means the unpatched vulnerabilities expose a significant user base. OnePlus and OPPO together ship millions of devices annually, and the shared codebase means any flaw in common components affects both brands. The “many more” phrasing suggests the vulnerability count extends well beyond the OnePlus 15 that Moorats used for the initial demonstration.
Unpatched Vulnerabilities Leave OnePlus and OPPO Users Exposed
OnePlus acknowledged the vulnerability and confirmed the device impact on September 24, 2026, but has not released patches. The unpatched status leaves all affected OnePlus and OPPO users vulnerable to any malware that incorporates Moorats’ exploit chain. While researchers typically withhold technical details after disclosing unpatched flaws to prevent immediate widespread exploitation, the acknowledgment and public disclosure mean attackers now know the vulnerabilities exist and can begin reverse-engineering OnePlus software to find and exploit them independently.
The risk increases over time. Each day without a patch extends the window during which malware developers can build working exploits and distribute malicious apps targeting the OnePlus privilege escalation chain. Once malware begins circulating, affected users have no defensive option beyond avoiding all app installations—an impractical mitigation for general smartphone use.
Privilege Escalation in Android Vendor Software and the Patching Gap
The OnePlus disclosure illustrates a persistent challenge in the Android ecosystem: vendor-specific software introduces vulnerabilities beyond those in the core Android operating system, and vendor patching timelines often lag behind Google’s own Android Security Bulletin cycle. While Google issues monthly security updates for core Android, manufacturers must separately patch their custom software layers like OxygenOS, creating gaps where vendor-introduced flaws remain unpatched even on devices running the latest vendor OS version.
For OnePlus and OPPO users, the immediate absence of patches means the best available mitigation is to avoid installing apps from untrusted sources and rely on Play Protect scanning to block known malware. However, these measures provide limited protection against a zero-day privilege escalation that does not yet appear in malware signatures. The long-term solution requires OnePlus to release patches and users to install them promptly, but until that happens, the vulnerability chain remains exploitable on millions of devices running current software.
