Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions

Many buyers rely on the OnePlus 15’s reputation for speed and security, yet a single malicious Android app can hijack the device and silently obtain full root privileges, exposing personal data and control. The prospect of an app operating without any permission contradicts the expectation of a locked‑down flagship, turning what should be a seamless user experience into a potential security nightmare. Security researchers discovered that the flaw exploits internal OxygenOS services, letting apps gain root access without any user consent.

Zamin.uz broadened the scope, labeling the issue a dangerous vulnerability affecting both OnePlus and Oppo smartphones, underscoring the systemic nature of the problem. CyberSecurityNews detailed the zero‑permission escalation pathway, confirming that ordinary apps can achieve root without user interaction. Android Headlines called the flaw a serious security issue and reiterated that it persists across recent OnePlus models, while CyberSecurityNews outlined how the OxygenOS service mishandles privilege escalation.

No official patch has been announced, and the coverage leaves open whether OnePlus will issue a corrective update before the vulnerability is widely exploited.