# Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions

> **Open Intelligence Dossier** · First detected: 2026-09-28 12:00 UTC · Category: Technology

## Executive Summary
Unpatched vulnerabilities in OnePlus and Oppo devices allow installed apps to gain root access without user permission via OxygenOS services.

## Intelligence Brief
A serious security vulnerability has been identified in OnePlus and Oppo smartphones, specifically affecting the OnePlus 15. According to reporting from The Hacker News and CyberSecurityNews, these flaws allow installed Android applications to obtain root access to the device without requiring any permissions from the user. The mechanism for this exploit involves OxygenOS services, which serves as the gateway for zero-permission apps to hijack the system's highest level of administrative control. This means a single malicious application could potentially seize total control over the device's internal operations. Coverage of this discovery is widespread across technology and security outlets. The Hacker News emphasizes that the flaws remain unpatched, while Cybernews warns that a single bad Android app could lead to a full hijack of a OnePlus 15 device.


CyberSecurityNews provides the specific technical context that the breach occurs through OxygenOS services. Additionally, Zamin.uz reports that the scope of the danger extends beyond just one model, noting that the vulnerability is present in both OnePlus and Oppo smartphones, indicating a broader systemic issue across these related hardware ecosystems. Context provided by Android Headlines highlights a significant lapse in the remediation process, stating that the security flaw has remained unfixed for six months. This duration suggests a persistent window of exposure for users of the affected hardware. Root access is the most privileged level of access on an Android device, and the ability for an app to gain this status without permissions bypasses the standard Android security model. The risk is amplified because the vulnerability allows apps that have been granted no special permissions to escalate their privileges silently.


Future developments to monitor include the release of an official patch from OnePlus and Oppo to close the OxygenOS service loophole. Based on the reporting from Android Headlines, the primary focus will be whether the company can resolve a flaw that has already persisted for half a year. Users are currently operating with an unpatched vulnerability that allows for systemic hijacking, making the deployment of a security update the only definitive resolution. Coverage does not yet specify a timeline for when a fix will be pushed to affected OnePlus 15 and Oppo devices.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| Cybernews | One bad Android app could hijack your OnePlus 15, researcher warns | [Source Link](https://news.google.com/rss/articles/CBMigAFBVV95cUxQZWxIQjdoVlVweklVV3hiZXpMaW0xVkNibHhteUJ3Z04xc3lBaU13Tjlab1hRZ0FGem1FNkVNRlBTdGpVZ20tNm5FeFVpVkRDTFQ5WTVlSFlndGNnMjVzVG9pOWRfaHJmZEVsRUVxUHlTRUFOQ19FSUxXOE9OM3V6Rg?oc=5) |
| CyberSecurityNews | OnePlus 15 Flaws Let Zero-Permission Apps Gain Root Access Through OxygenOS Services | [Source Link](https://news.google.com/rss/articles/CBMid0FVX3lxTE9sSEhDb2wzNDBaT0tZZU5ZUHdnZk5BUkY0dk1CQ0xHc1NZSUxrUFdNcFRHOGZwSUgxUTRSYkVDRi1IWlVtb2NRTWJXRlRQXzYxQVVoLWxSeTN0NHZxYkpQaEJsYkRobmlmbE03NF92OXBSblhRZTV30gHfAkFVX3lxTFBRSkMtYThHUlkyYW1tNFlVVnJqQXA1RXdtZ2ZpXzJDVlFWYnNrWW54eEFWeHdGcllDU0k2bUhya0JqMGFrNV9wOHh6c013OWFFaFZTZ0VVbHBpdW5wTEppbWVMQ3ladkNnaDhKM19Ka3BOYzZQRnVEamxnb1J5SGZXamp6SlFZc0ZTekI4djl1aC05S21RVExKOW9kLUFDNE56YnVYaHowbjhCVDZCbWdSaFF6RDVsQ1gxZlZLMm1VdXQ1SHV4MXpiemVJYUhkSXlJbGZZTW1zb1p0WUV) |
| Android Headlines | A Serious OnePlus Security Flaw Lets Apps Root Your Phone, and It's Still Not Fixed After 6 Months | [Source Link](https://news.google.com/rss/articles/CBMi2gFBVV95cUxPU3pqSTZFMXdWcjdrSjBrdjZ5WmxYZTBiSm16LUk4cFhLVl94UzRzcE5VQm5kZU02TllSSzAzZ25JVjVwbUt3ZlRkVTNmR0lTT3UtbzM4Tm1NQ3RLTFFwa0s5eWhzRlpEWXE2YzR2eGtGREl4SWZRa3VpT1NnS3U5WXJmbjNxWUhlamZTT0VpeGxOcGkxSzh0UG0wYVBXZWVpd3ZyTXhNbS0wZTM1cWs5dnIxRGcxc3ptbncxNHNhSmQ1ZWlwa1Q4Tm5HSUJXR3hKYS1WekV6a25lQQ?oc=5) |
| Zamin.uz | Dangerous vulnerability discovered in OnePlus and Oppo smartphones | [Source Link](https://news.google.com/rss/articles/CBMirgFBVV95cUxNMTFCV0hhck1qRzg4MzMwc2FuSGZ4NjJiN1NnXzFQNm5WdkZLWFB2WGUxd3o2QVBRSkVlRVBGUGFpSUZjcGtyM1AwdG5jdW1OWmxuQVRyUEJRbmIzWVpBSzE2cExjYUVnQzN3LVJQbVFYVUUwRHNvNUJXQkFfNEpNRDdueHhxRGZFa09sRF84ZHQ0Z1c2ZTNTbzhLZll0QWVaaE4yUGNqLU5xaTlybmc?oc=5) |
| The Hacker News | Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions | [Source Link](https://news.google.com/rss/articles/CBMiggFBVV95cUxObFVFNUFkaV9idGI1MUx5dHFUeWtFZXMtb1VqMjVreTF0bHpfbUJJYV84X1Fzc0JSZXVpTEQzQUw2OWhDNXVST1RmNE15angtT3MwX1NjUmRKWFpfYU9HRG5RQjN1NGtnTWx6S0RkVHN0dFFQTHRvU0ZFSFFoakxydWJR?oc=5) |

---
*Canonical Source: https://pulse.byoaiapps.com/trend/2026-09-28/unpatched-oneplus-flaws-let-installed-android-apps-gain-root-without-permissions*