OnePlus OxygenOS local privilege-escalation flaws security flaw
Vulnerability
Summary
Hide ▲
Show ▼
Unpatched OnePlus OxygenOS local privilege-escalation flaws let a malicious no-permission app gain root on affected phones. The chain uses AtlasService and olc2 to move from an installed app to system-level control. OnePlus had not released a fix at disclosure time, and the issue may extend beyond the OnePlus 15 to other OnePlus and OPPO devices.
Related Happenings
Unisoc modem firmware VoLTE privilege-escalation flaw (CWE-1189)
Vulnerability
H score28
First: 17.08.2026 13:52
Last: 17.08.2026 13:52
Sources 1
About this happening:
Researchers published a CWE-1189 privilege-escalation flaw in Unisoc modem firmware that can elevate modem-level access to full Android kernel control through a VoLT...
Unisoc modem firmware VoLTE privilege-escalation flaw (CWE-1189)
VulnerabilityAbout this happening: Researchers published a CWE-1189 privilege-escalation flaw in Unisoc modem firmware that can elevate modem-level access to full Android kernel control through a VoLT...
Grandstream GXP1600 series unauthenticated stack-based buffer overflow remote code execution flaw (CVE-2026-2329)
Vulnerability
H score37
First: 18.02.2026 18:35
Last: 18.02.2026 18:35
Sources 1
About this happening:
The Grandstream GXP1600 series has a critical CVE-2026-2329 stack-based buffer overflow that can enable unauthenticated remote code execution on susceptible VoIP phone...
Grandstream GXP1600 series unauthenticated stack-based buffer overflow remote code execution flaw (CVE-2026-2329)
VulnerabilityAbout this happening: The Grandstream GXP1600 series has a critical CVE-2026-2329 stack-based buffer overflow that can enable unauthenticated remote code execution on susceptible VoIP phone...
Timeline
-
24.09.2026 21:10 1 articles · 13d ago
Rasmus Moorats reports two OnePlus flaws to the company
Initial DisclosureOn April 18, 2026, Rasmus Moorats reports two OnePlus flaws to OnePlus after chaining AtlasService and olc2 into a local root path that a malicious app can trigger without special permissions.
Show sources
- Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions — thehackernews.com — 24.09.2026 21:10
-
24.09.2026 21:10 1 articles · 13d ago
OnePlus confirms the flaws and warns Moorats against disclosure
Legal Policy Action UpdateOn May 20, 2026, OnePlus confirms both flaws, says the same issues may affect more OnePlus and OPPO devices, and tells Moorats that the company alone controls when a flaw can be made public.
Show sources
- Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions — thehackernews.com — 24.09.2026 21:10
-
24.09.2026 21:10 1 articles · 13d ago
OnePlus gives a fix update and asks Moorats to hold publication
Mitigation Patch UpdateOn June 22, 2026, OnePlus says a fix is scheduled, asks Moorats to hold off on publication, and continues to claim exclusive final control over vulnerability disclosure.
Show sources
- Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions — thehackernews.com — 24.09.2026 21:10
-
24.09.2026 21:10 1 articles · 13d ago
Moorats asks OnePlus for an update and gets no reply
Untyped PhaseOn July 20, 2026, Moorats asks OnePlus for an update on the fix and disclosure timeline, but OnePlus does not reply.
Show sources
- Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions — thehackernews.com — 24.09.2026 21:10
-
24.09.2026 21:10 1 articles · 13d ago
Moorats asks OnePlus again for an update and gets no reply
Untyped PhaseOn September 11, 2026, Moorats asks OnePlus again for an update on the fix and disclosure timeline, but OnePlus does not reply.
Show sources
- Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions — thehackernews.com — 24.09.2026 21:10
-
24.09.2026 21:10 2 articles · 13d ago
Moorats publishes the chained OnePlus root flaws
Technical Analysis UpdateOn September 24, 2026, Moorats publishes the chained OnePlus flaws that let a malicious app already installed on a OnePlus 15 running the latest OxygenOS gain root through AtlasService and olc2; he also says the same problem applies to an older OnePlus 12 Pro and likely affects OxygenOS 16 more broadly, while OnePlus still has no fix.
Show sources
- Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions — thehackernews.com — 24.09.2026 21:10
- Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions — thehackernews.com — 24.09.2026 21:10