Most mobile risk models assume: no permissions requested = low risk. A newly disclosed OxygenOS vulnerability breaks that assumption completely.
Security researcher Rasmus Moorats found two chained flaws in OnePlus 15 devices that let a completely permissionless Android app execute code with full root privileges — no camera, storage, or SMS access needed. He reproduced it on a fully stock, unmodified device on the first attempt.
The exploit chain
- AtlasService — a OnePlus debugging service that runs as root but never verifies the calling app's identity. A crafted request gets passed unsanitized into a system command.
-
olc2 — a hardware interface whose only guard is checking that the caller already has root, which stage one just handed over via
doShell.
Chained together, these two "debugging oversights" become a full sandbox escape with no Android permissions ever requested.
Why this matters for security tooling
Permission-based heuristics are the backbone of most mobile threat defense (MTD) and MDM policies. This proof-of-concept app would sail past every one of them, because static analysis flags requested permissions — not privileged system services with broken caller verification.
Current status
- ✅ Fix confirmed: OxygenOS
16.0.10.500(EX01) - ⚠️ OnePlus confirms broader OPPO device ecosystem affected
- ❌ No CVE assigned yet
- ❌ No full affected-device list published
Full breakdown — exploit mechanics, disclosure timeline, SOC detection strategies, and ADB commands for fleet-wide patch verification — in the original post 👇
OnePlus 15 Root Exploit: Zero-Permission Apps Can Take Full Control
OnePlus 15 root exploit lets zero-permission apps gain full control via OxygenOS flaws. Update now — here's what's affected and how to stay safe.
xpert4cyber.com
Top comments (0)