Unpatched OnePlus Vulnerabilities Enable Malicious Apps to Gain Root Access Without Permissions

Researchers discovered unpatched vulnerabilities in OnePlus devices allowing malicious apps to gain root access without user permissions by exploiting chained flaws in system services. The company restricted disclosure rights, leading to a delayed public release of details after five months of communication.

A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus's own software to gain root access, the highest level of control over an Android phone.

OnePlus told him the same flaws affect many more of its own devices and those of OPPO, though it has not

Read original article