OnePlus 15’s OxygenOS Vulnerabilities Enable Permission‑Free Apps to Gain Root

A security researcher has uncovered a pair of flaws in the OnePlus 15’s OxygenOS that allow a seemingly harmless Android app to obtain root privileges without requesting any special permissions.

The vulnerabilities, identified by Rasmus Moorats, involve a combination of a privilege‑escalation bug in the OS’s service‑manager and a flaw in the way the system validates package signatures. By chaining these issues, an app that appears benign can silently elevate its rights to the highest level of control on the device.

Root access on Android devices bypasses the normal sandbox that separates applications, granting unrestricted read‑write capabilities across the entire file system, the ability to install or remove other apps, and control over hardware components. In the context of a OnePlus 15 running the most recent OxygenOS build, the exploit works even though the app does not request the “root” or “system” permissions that users typically see in the Play Store.

The discovery raises concerns for both individual users and organizations that deploy OnePlus smartphones in corporate environments. A malicious actor could use the flaw to exfiltrate personal data, install surveillance tools, or manipulate the device for financial gain. Because the exploit does not rely on social engineering beyond convincing the victim to install an app, it could be delivered through third‑party app stores, malicious advertisements, or compromised legitimate apps.

OnePlus has not yet issued a public patch, and the company’s official channels have only acknowledged that a security investigation is underway. Security experts advise owners of the OnePlus 15 to postpone installing apps from unknown sources, keep the device’s software up to date, and monitor for firmware updates that address the vulnerabilities. The incident underscores the broader challenge of timely patching in the Android ecosystem, where device manufacturers often customize the base operating system and may lag behind upstream security fixes.

Analysts expect a corrective update to be rolled out within the next few weeks, given the severity of a root‑level exploit. In the meantime, the research highlights the importance of thorough code audits by OEMs and the need for users to remain vigilant about the permissions and provenance of the apps they install.