Apps are getting root privileges on OnePlus

OxygenOS, which runs on OnePlus and OPPO phones, came with two vulnerabilities that let a malicious app gain root privileges without requesting any permissions. On Android, a normal app runs in a tight sandbox and can’t access the rest of the device. This chain breaks that sandbox completely.

Two bugs combine for full privileges

The first vulnerability, CVE-2026-70386, is in OxygenOS’s telemetry-collecting AtlasService. The service accepts a setEvent call without checking which app made it. The value sent under the name atlas_event_multimedia_audio_dumpsys is written to a system property and passed to the audioDumpInfo service, which runs as root. The value is then appended to a shell command, so the app can run commands as uid 0.

The second vulnerability, CVE-2026-70387, is in the vendor-owned olc2 logging HAL. The doShell method runs the incoming command directly through /vendor/bin/sh; the only check is whether the caller is uid 0. Once the first vulnerability gets the app to uid 0, it opens this door too and gets a shell with all Linux privileges. NVD gives the two vulnerabilities scores of 8.5 and 8.4 on the CVSS 4.0 scale.

Which versions are affected

According to the NVD record, builds from OxygenOS 16.1.0 up to but not including 16.1.10.500, from 16.0.0 up to but not including 16.0.5.1200, and from 15.0.0 up to but not including 15.0.0.2000 are affected. The researcher who found the vulnerability tested it on a OnePlus 15 (CPH2747), and the app they prepared worked on the first try; they developed it on a OnePlus 12 Pro. OnePlus confirmed that the vulnerability affects many OnePlus and OPPO devices across different software versions. According to information the company provided on September 28, 151 of the devices under maintenance had received the patch, and 18 devices were awaiting the update.

How to close it

Check the build number in the phone’s settings. On the 16.1.0 line, builds whose last number is 500 or higher are considered fixed; on the 16.0.0 line, 1200 or higher; on the 15.0.0 line, 2000 or higher. If you don’t see an update, try again in a few days; the patch is rolled out gradually on a per-device basis. In the meantime, stop installing APKs from outside the store. The entire chain works by installing an app that requests no permissions and opening it once.

The process side

The vulnerabilities were reported to OnePlus on April 18, 2026. On May 20, OnePlus sent the researcher an email saying that legal action would be taken if they were published. The fix for the OnePlus 15 was released on August 18, and the technical write-up came out on September 24. The sources do not indicate that the vulnerabilities have been used in the wild. Still, because root privileges open the door to system areas normally inaccessible to apps and to other apps’ data, a delayed patch increases the risk.

Source: NVD · nns.ee