Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions
Unpatched OnePlus flaws allow installed Android apps to gain root access without permissions.
Researcher Rasmus Moorats discovered two unpatched vulnerabilities in OnePlus's OxygenOS that allow a malicious, locally installed app to gain root access without requiring any user permissions. OnePlus confirmed the flaws affect multiple devices and those of OPPO, but has not disclosed which models. The company also clashed with Moorats over disclosure, asserting its right to control when and how vulnerabilities are made public, even threatening legal action.
AI summary of the linked source. Not reviewed by an editor. How this works
Run OnePlus?
Get an email when a new story names OnePlus, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTwo unpatched vulnerabilities in OnePlus's OxygenOS allow locally installed malicious apps to silently escalate privileges to root level, bypassing Android's permission model entirely. This is critical because root access exposes the entire device — including credentials, communications, and sensitive data — without any user interaction or awareness. The situation is compounded by OnePlus's failure to promptly patch confirmed flaws and its aggressive stance toward the researcher who responsibly disclosed them. Vendor attempts to suppress or control vulnerability disclosure undermine the security community's ability to protect end users, and delays in patching leave millions of devices at risk. This case highlights that device manufacturers must treat privilege escalation vulnerabilities as critical-priority patches.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.