Loading story…
A researcher disclosed a two-stage local privilege-escalation chain affecting OnePlus and OPPO devices running OxygenOS, including the OnePlus 15 on OxygenOS 16.0.3.503 and the OnePlus 12 Pro. A normally installable sideloaded app with no declared permissions can invoke the root-running AtlasService and inject shell commands through the audiodumpinfo debug service, obtaining execution as root in the SELinux dumpstate domain.
The chain then abuses the Oplus Log Core (olc2) vendor HAL's UID-0-restricted doShell method to run commands in the vendor_qti_init_shell SELinux domain, whose bounding set includes all Linux capabilities. OnePlus reportedly confirmed in May that multiple products and software versions are affected, but no complete affected-device list, CVE identifier, remediation details, or evidence of exploitation in the wild had been published.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A researcher published a two-stage local privilege-escalation chain allowing an unpermissioned Android app to obtain uid-0 execution through OxygenOS AtlasService and then execute commands through the Oplus Log Core vendor HAL. The chain was confirmed on a OnePlus 12 Pro and a OnePlus 15; no complete affected-device list or remediation details had been provided by OnePlus at publication.
OnePlus reportedly confirmed that the vulnerabilities affected multiple products and threatened legal action if the research was published.
OnePlus requested further details about the reported vulnerabilities, and the researcher supplied the requested information the same day.
The researcher reported the AtlasService command-injection issue and the Oplus Log Core HAL doShell authorization flaw to OnePlus security contacts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
blog.nns.ee
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researcher Lukas Maar disclosed **OEMPocalypse**, a cross-OEM Android privilege-escalation technique targeting manufacturer-added kernel components rather than generic Linux kernel flaws or chipset drivers. The chains exploit a page use-after-free in an OEM kernel driver and, when SELinux restricts driver access, first use an OEM sandbox escape. A stale mapping to a freed physical page is then reclaimed to obtain page-level kernel-memory access and kernel-level compromise. The technique reportedly avoids both a KASLR information disclosure and control-flow hijacking, limiting the effectiveness of several slab-allocation and CFI hardening measures. Its page-reclamation method was reported to function unchanged on Linux kernels 5.15 through 6.12, with tailored chains demonstrated against Samsung, Xiaomi, and Oppo software stacks on stock, locked-bootloader Galaxy S26 Ultra, Galaxy S26, Xiaomi 17, Oppo Find X9 Ultra, and OnePlus Ace 6 Ultra devices running July 2026 firmware.
Sep 2, 2026
A high-severity flaw in the preinstalled `com.oneplus.account` app on OnePlus 13R devices allows any installed malicious app to obtain an authenticated OnePlus Cloud session token. The exported `OPAccountProvider` content provider relies on `com.oneplus.account.READ_ACCOUNT_INFO`, a permission that third-party apps can declare because it is not restricted to software signed by OnePlus; an app can then invoke `get_account_oneplus_token` to retrieve `oldSecondaryToken` without user interaction beyond installation. The exposed token was accepted by the OnePlus Cloud API and was demonstrated to enable modification of victim account data, creating a path to account session takeover. Doyensec confirmed the token exposure remained in firmware `CPH2691_16.0.10.500(EX01)` and disclosed the issue publicly after OnePlus had not remediated it.
Sep 10, 2026
STAR Labs detailed two exploit chains showing how vulnerabilities in the Arm Mali GPU driver could be turned into full kernel compromise on Google Pixel phones. One write-up analyzed `CVE-2023-6241`, a race condition in `kbase_jit_grow` on a Pixel 8 running Android 14, where stale allocation state after a lock drop left some physical pages backed but unmapped. That inconsistency was used to trigger a page use-after-free, reclaim the freed page, and build arbitrary kernel read/write primitives. The exploit then overwrote kernel code to disable SELinux enforcement and invoked `commit_creds(&init_cred)` to gain root from the unprivileged `untrusted_app_27` context; STAR Labs said excessive `WARN_ON` logging initially stretched exploitation to about 10 minutes before testing reduced runtime to under five seconds. A second write-up showed that `CVE-2023-48409` alone was sufficient to compromise a Pixel 6 Pro, contradicting earlier assumptions that exploitation also required `CVE-2023-26083`. STAR Labs described the bug as an integer-overflow-driven out-of-bounds write in the Pixel Mali driver and said exploitation bypassed `CONFIG_HARDENED_USERCOPY` by targeting page-allocator-backed objects and using pagetable spraying techniques inspired by Dirty Pagetable. The researchers also mapped Android-specific constraints including seccomp, SELinux, and privilege-escalation mechanics, and found that while the earlier pointer-leak bug still existed on affected devices, the practical path relied on leaking a `kbase_context` object exposing a `task_struct` pointer for direct credential manipulation. Both reports said the affected issues were patched in later Android security updates.
Jun 29, 2026