OnePlus Flaw Lets Apps Gain Root Without Permissions

Introduction

In a surprising turn for Android security, a researcher demonstrated that a seemingly harmless app installed from the Play Store—or any other source—can silently escalate to full root access on a OnePlus 15 running the latest OxygenOS. The attack does not require the user to grant any dangerous permissions, making it especially stealthy. By chaining two weaknesses present in OnePlus’s proprietary software stack, the exploit grants the highest level of control over the device, opening the door to data theft, spyware installation, and persistent backdoors.

OnePlus confirmed that the same flaws are present across many of its own devices and also affect a number of OPPO smartphones, suggesting a broader impact within the BBK Electronics ecosystem. While the vendor has been notified, patches have not yet been released at the time of writing, leaving millions of users potentially exposed.

Understanding the Vulnerability Chain

The exploit hinges on two distinct flaws that, when combined, bypass Android’s permission model. The first vulnerability resides in a privileged system service that improperly validates input from third‑party applications, allowing a malicious app to inject crafted data. The second flaw is a race condition in a system update mechanism that temporarily elevates the process’s privileges during a specific window.

• First Flaw: Insufficient sanitization of intent extras in a system‑level broadcast receiver enables an attacker to trigger a privileged code path.
• Second Flaw: A timing issue in the OTA (over‑the‑air) update service creates a brief moment where the calling process inherits root capabilities.
• By chaining these, an app can first gain a foothold in the privileged service and then ride the race condition to execute arbitrary code as root.

Because neither step requires the user to approve dangerous permissions such as SYSTEM_ALERT_WINDOW or ACCESS_FINE_LOCATION, the attack can be delivered via an app that appears benign—perhaps a game, utility, or even a wallpaper changer.

Impact Across OnePlus and OPPO Devices

OnePlus’s admission that the flaws affect "many more" of its own devices indicates that the vulnerable components are shared across multiple OxygenOS releases. Furthermore, the company noted that OPPO handsets—which share a significant amount of underlying firmware with OnePlus—are also susceptible. This cross‑brand exposure amplifies the potential reach of the exploit.

Devices likely impacted include, but are not limited to:

• OnePlus 9, 9 Pro, 10 series, 11 series, and the latest OnePlus 15
• OPPO Find X series, Reno series, and certain A‑series models that run ColorOS based on the same OxygenOS core

Given the popularity of these lines in markets such as India, Europe, and North America, the number of potentially affected devices could easily exceed several million.

Technical Details of the Exploit

The researcher’s proof‑of‑concept (PoC) demonstrates a straightforward sequence:

1. The malicious app sends a specially crafted broadcast intent to a privileged receiver that lacks proper validation.
2. This triggers the first flaw, granting the app temporary access to a privileged internal API.
3. Using that API, the app initiates an OTA check‑in process, which opens the race‑condition window in the second flaw.
4. During that window, the app executes a shell command with root UID, allowing it to install additional modules, modify system partitions, or install a persistent backdoor.

Notably, the exploit does not rely on unlocking the bootloader, flashing custom recoveries, or exploiting kernel vulnerabilities—making it considerably easier to weaponize and harder to detect via traditional integrity checks.

Mitigation Steps for Users and Developers

Until an official patch is released, users can adopt several defensive measures:

• Install applications only from trusted sources and scrutinize app permissions, even if they appear innocuous.
• Enable Google Play Protect and consider using a reputable mobile security solution that monitors for abnormal privilege escalation.
• Keep the device’s software up to date as soon as OnePlus pushes the fix.
• For advanced users, consider using a custom ROM that has already patched the vulnerable components, though this carries its own risks.

Developers should audit their apps for any unintended use of privileged broadcast receivers or services that could be abused. Implementing strict input validation and using the android:exported="false" attribute for components that do not need to be accessed by other apps can reduce the attack surface.

Conclusion

The discovery of a permission‑free root exploit on OnePlus devices serves as a stark reminder that device security extends beyond the permissions dialog shown at install time. Attackers are increasingly leveraging subtle logic flaws in vendor‑specific software to achieve elevated privileges, bypassing the very mechanisms designed to protect users. Staying vigilant, applying updates promptly, and employing layered security controls are essential steps to mitigate risk.

While users await an official patch from OnePlus, leveraging comprehensive security platforms—such as those offered by Grivyonx Cloud—can help detect and block abnormal behavior, providing an additional safeguard against sophisticated mobile threats. By combining timely patch management with intelligent threat detection, both individuals and organizations can better defend their Android ecosystems against emerging exploits.