Unpatched OnePlus Flaws Allow Android Apps to Gain Root Without Permissions

Security researcher Rasmus Moorats disclosed that two separate flaws in OnePlus's proprietary OxygenOS software can be chained together to grant a malicious application full root privileges on a OnePlus 15, even though the app requests no special permissions. The findings were first reported by The Hacker News and highlight a rare instance where an installed app can bypass Android's permission model entirely.

The attack works by exploiting a privilege‑escalation bug in the system's package manager and a second flaw in the device's init process. When combined, these vulnerabilities allow the malicious code to execute with the highest level of system authority, effectively taking control of the device without the user’s knowledge or consent.

OnePlus confirmed that the vulnerabilities are not limited to the OnePlus 15 and affect a broader range of its own devices as well as many models from sister brand OPPO. The company has acknowledged the issue and is preparing a security patch, urging users to install updates as soon as they become available through the standard OTA process.

For IT professionals and students in Australia, the incident underscores the importance of maintaining up‑to‑date firmware on mobile devices, especially in corporate environments where compromised phones can become entry points for network attacks. Organizations are advised to enforce regular patch cycles and consider mobile device management solutions that can enforce timely updates across fleets of devices.

As mobile security threats evolve, training programmes such as those offered by Wepro Technology can help Australian IT workers and students deepen their understanding of vulnerability assessment and mitigation, preparing them to respond effectively to incidents like the OnePlus root exploit.