Untrusted Android Apps Can Gain Root on OnePlus and OPPO Devices
Vulnerability Disclosure · 8 sources · Updated 2mo ago · First seen Sep 24, 2026
A researcher disclosed a two-stage local privilege-escalation chain affecting OnePlus and OPPO devices running OxygenOS, including the OnePlus 15 on OxygenOS 16.0.3.503 and the OnePlus 12 Pro. A normally installable sideloaded app with no declared permissions can invoke the root-running AtlasService and inject shell commands through the audiodumpinfo debug service, obtaining execution as root in the SELinux dumpstate domain.
The chain then abuses the Oplus Log Core (olc2) vendor HAL's UID-0-restricted doShell method to run commands in the vendor_qti_init_shell SELinux domain, whose bounding set includes all Linux capabilities. OnePlus reportedly confirmed in May that multiple products and software versions are affected, but no complete affected-device list, CVE identifier, remediation details, or evidence of exploitation in the wild had been published.
