Executive Summary
A researcher has disclosed a critical exploit chain affecting OnePlus and OPPO devices running OxygenOS 16 (and potentially earlier versions like OxygenOS 15/14). The chain allows a standard, no-permission Android application to escalate privileges to UID 0 (root) with full Linux capabilities. This is achieved by first exploiting a command injection in the OnePlus AtlasService to reach a restricted root context (dumpstate), followed by utilizing a 'doShell' method in the vendor-specific olc2 HAL to gain unrestricted system-level control.
OnePlus was notified in April 2026 and confirmed the vulnerabilities in May 2026, though they notably attempted to discourage public disclosure by citing legal liability and claiming exclusive rights to vulnerability details. As of the researcher's disclosure on September 24, 2026, no official patch has been confirmed for all affected devices, and the manufacturer has not assigned unique CVE IDs to these specific flaws, though the report mentions a related telephony bypass (CVE-2025-10184) from a previous campaign.
While the attack requires local installation of a malicious app, the lack of required permissions makes it a potent tool for sophisticated mobile malware. Organizations using OnePlus or OPPO devices in high-security environments should enforce strict application whitelisting and monitor for unusual binder service calls.