Affected Systems

OnePlus devices running OxygenOS 16 (confirmed on OnePlus 15 and OnePlus 12 Pro) and multiple OPPO devices. OnePlus confirmed the vulnerabilities affect many of its own devices and OPPO products but has not disclosed specific model lists. No CVE assigned.

Exploitation Status

No evidence of active exploitation. Proof-of-concept demonstrated by researcher Rasmus Moorats on September 24, 2026. Attack requires local access via a malicious installed app.

Business Impact

A malicious app installed on affected devices can escalate to full root privileges without requesting any permissions or user interaction. The attack chains two flaws: AtlasService command injection (root in dumpstate context) and olc2 hardware service unrestricted command execution (full Linux capabilities including kernel code loading). This enables complete device compromise at the system level. Attack vector is local only—requires the user to install a malicious app first. No patch available as of disclosure date; OnePlus has not issued CVE identifiers or public advisory.

Urgency

🟡 Within a week

Recommended Actions

  • Restrict app installations to Google Play Store and trusted sources only on all OnePlus and OPPO devices running OxygenOS 16 or ColorOS equivalents
  • Deploy mobile device management (MDM) policies to block sideloading and enforce app vetting for corporate OnePlus/OPPO devices
  • Monitor OnePlus security bulletins at https://www.oneplus.com/security for patch availability and apply OxygenOS updates immediately when released
  • Review installed applications on affected devices and remove any apps from unknown or untrusted developers
  • Consider replacing OnePlus/OPPO devices in high-security environments until vendor issues patch and demonstrates improved vulnerability disclosure practices