Unpatched OnePlus Flaws Let Android Apps Gain Root Without Permissions

A newly disclosed security issue in OnePlus and OPPO devices shows how quickly a trusted, up-to-date phone can become a serious business risk. Security researcher Rasmus Moorats demonstrated that a malicious app installed on a OnePlus 15 running the latest OxygenOS can silently gain root access—without asking for any special permissions.

For small businesses that allow employees to use Android phones for work, this kind of vulnerability is a reminder that mobile security cannot be an afterthought. Even legitimate-looking apps can become a gateway for attackers when device manufacturers leave critical flaws unpatched.

---

Key Takeaways

• A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app that requests no special permissions.
• The exploit chains two vulnerabilities in OnePlus’s own system software, not in Android itself.
• OnePlus has acknowledged the same flaws affect multiple OnePlus and OPPO models.
• Root access gives an attacker full control of the device, including data, apps, and potentially business accounts.
• Small businesses should strengthen mobile security policies, app controls, and device management to reduce risk.

---

What Happened: Root Access from a “Normal” App

Moorats identified and combined two separate weaknesses in OnePlus’s software stack to gain root access on a OnePlus 15:

• Vulnerability in OnePlus system components – The flaw exists in proprietary software that ships with OxygenOS, not in the core Android open-source platform.
• Exploit chain – By chaining two flaws together, a regular app can escalate its privileges step by step until it reaches full root access.

What makes this issue especially concerning is that the malicious app:

• Does not need dangerous permissions (like SMS, camera, or location) to execute the attack.
• Can appear harmless during installation because users see a standard permission list.
• Can run its payload quietly in the background, without obvious signs of compromise.

In other words, a user who is normally cautious about app permissions might still install the app, because nothing looks suspicious on the surface.

---

Why This Matters for Small Businesses

Many small businesses rely on employees’ phones to access email, messaging apps, shared documents, CRM systems, and other cloud tools. A vulnerability that grants root access turns a personal or company-owned phone into a powerful attack platform.

With root privileges on a compromised OnePlus or OPPO device, an attacker could potentially:

• Steal business emails, attachments, and chat messages.
• Access stored credentials for corporate apps or VPNs.
• Install additional malware or spyware that persists across reboots.
• Intercept multi-factor authentication (MFA) codes sent via SMS or app.
• Capture keystrokes and screen content to target banking or payment apps.

Because the vulnerability lies in manufacturer software, traditional Android security features and permission prompts are less effective. Even well-designed app permission policies may not fully protect against this type of flaw.

---

Who Is Affected?

OnePlus has confirmed that the same underlying vulnerabilities affect:

• The OnePlus 15 tested by Moorats, running the latest OxygenOS at the time of disclosure.
• Other OnePlus devices using similar OxygenOS components.
• Certain OPPO devices, which share code and architecture with OnePlus phones.

Although the full list of impacted models has not been publicly detailed, the overlap between OnePlus and OPPO software means a broad range of devices may be at risk until a patch is released and installed.

For business owners and IT leads, this means:

• You may not know exactly which employee devices are vulnerable unless you track device models and OS versions.
• Relying on “latest Android version” is not enough; manufacturer updates must also address their own software.
• Any policy that allows unmanaged personal devices to access business systems increases exposure.

---

Understanding Root Access and Mobile Risk

Root access is the highest level of control on an Android device, similar to full administrator access on a server or desktop. When an app gains root access:

• It can bypass normal sandboxing between apps.
• It can read or change system files and protected app data.
• It can hide its own presence and disable security tools.

For attackers, root access is valuable because it makes their malware more persistent and more capable. For businesses, it means that once a device is compromised, you have to assume all data and accounts on that device may be exposed.

---

How Could a Malicious App Get Installed?

Even security-conscious users can be tricked into installing a malicious app that abuses this kind of vulnerability. Common scenarios include:

• Lookalike apps posing as popular tools or games on third-party app stores.
• Links in phishing emails or messages that lead to APK downloads outside the official store.
• Social engineering, where someone claims an app is required for work, rewards, or access to exclusive content.

Because the app does not request alarming permissions, users may feel more comfortable installing it. On unmanaged devices, there is often no technical control to stop them.

---

Practical Steps for Small Businesses

1. Take Stock of Devices and Platforms

Start by understanding your current mobile landscape:

• Identify which employees use Android devices for work, including OnePlus or OPPO phones.
• Clarify whether those devices are company-owned or personally owned (BYOD).
• Document what business apps and accounts they access (email, file storage, CRM, finance tools, etc.).

2. Update and Patch Aggressively

Encourage and enforce regular updates:

• Apply the latest OxygenOS or OPPO updates as soon as security fixes are released.
• Turn on automatic updates for both the operating system and apps, where possible.
• Communicate clearly with staff about why timely updates matter, especially in response to high-impact vulnerabilities like this one.

3. Restrict App Sources and Installations

Reduce the chances of malicious apps getting onto devices:

• Require that work-related devices install apps only from the official Google Play Store or a vetted internal catalog.
• Disable “Install from unknown sources” on company-managed devices.
• Set clear policies for BYOD devices that access business email or files.

4. Use Mobile Device Management (MDM) or Enterprise Mobility Tools

If your business relies heavily on smartphones, it may be time to formalize control:

• Implement an MDM or mobile application management (MAM) solution to:
• Enforce security settings (screen locks, encryption, app source restrictions).
• Separate work and personal data on employee devices (work profiles).
• Remotely lock or wipe business data if a device is compromised.
• Limit access to sensitive systems to devices that meet specific security baselines.

5. Harden Your Accounts and Data Access

Assume that any one device could be compromised and design your defenses accordingly:

• Require multi-factor authentication (MFA) for email, file storage, and admin accounts.
• Prefer app-based or hardware-based MFA over SMS where possible.
• Minimize how much data is stored locally on devices; use secure, cloud-based tools with access controls.

6. Train Staff to Recognize Mobile Risks

Human decisions often determine whether a malicious app gets installed:

• Educate employees about:
• The risks of installing apps from links in emails or messages.
• How to verify developer names and app reviews in the Play Store.
• The importance of reporting suspicious behavior on their phones immediately.
• Include mobile-focused scenarios in your regular security awareness training.

---

Preparing for Future Device Vulnerabilities

This OnePlus/OPPO case is not the first time manufacturer-specific software has introduced serious security issues, and it will not be the last. For small businesses, the key lesson is to treat mobile devices as part of your core security posture—not as an afterthought.

As you refine your approach, focus on:

• Visibility – Knowing which devices touch your data and services.
• Control – Having technical and policy tools to manage those devices.
• Resilience – Designing systems so that one compromised phone does not lead to a major incident.

---

Conclusion: Turn a Headline Risk into a Security Upgrade

The ability for a normal-looking app to gain root access on a modern OnePlus device is a clear reminder that even up-to-date phones can expose your business. While individual flaws like this will be patched over time, the broader problem—complex software stacks with hidden vulnerabilities—will persist.

By tightening mobile policies, improving device management, and hardening access to your business systems, you can use incidents like this as a catalyst to improve your overall security posture. The goal is not to eliminate every possible mobile risk, but to make it much harder for a single compromised device to harm your business.

If you are working through how to align your website, applications, and mobile access with modern security practices, Izende Studio Web can help you plan and implement practical protections that fit a small-business budget.

Explore Izende Studio Web security and development services