A malicious app with no permissions can root a OnePlus 15 running OxygenOS, thanks to two unpatched flaws. The same issues affect many OnePlus and OPPO devices.
Imagine this: you download an app, install it, and it never asks for a single permission. You think you're safe. Then, quietly, it takes full control of your phone.
That's exactly what happened with a OnePlus 15 running the latest OxygenOS. A security researcher named Rasmus Moorats found a way to chain two flaws in OnePlus's own software to gain root access—the highest level of control over an Android phone. Root access means an attacker can do just about anything: read your messages, steal passwords, install spyware, and more. And the scariest part? The malicious app didn't need any special permissions to pull it off.
OnePlus confirmed that the same flaws affect many of its other devices, plus some from its sister brand, OPPO. They haven't released a fix yet, which leaves millions of users potentially at risk.
### How can a simple app become so dangerous?
Android is built with layers of security. Normally, apps run in a sandbox and need your permission to access things like your camera or contacts. But when a flaw exists in the system itself—especially in the manufacturer's own software—those layers can crumble.
Moorats found two separate bugs that, when combined, bypassed all the usual safeguards. It's like finding two weak spots in a castle wall and using them together to sneak inside. The first flaw might let an app do something it shouldn't, and the second flaw escalates that into full root access. No permissions required.
This isn't just a OnePlus problem. It highlights a bigger issue: even the software that manufacturers add on top of Android can introduce serious security holes.
### What does this mean for you?
If you own a OnePlus or OPPO device, you might be wondering what to do. Here are a few practical steps:
- **Stay updated.** As soon as OnePlus releases a patch, install it. Security updates are your first line of defense.
- **Be picky about apps.** Only download from trusted sources like the Google Play Store, and check reviews and developer info.
- **Watch for unusual behavior.** If your phone suddenly slows down, gets hot, or shows pop-ups, it could be a sign of malware.
- **Consider security software.** A reputable mobile security app can sometimes catch threats before they do damage.
> "Root access is the keys to the kingdom," says Moorats. "Once an app has it, there's almost nothing it can't do."
### The bigger picture
This discovery is a wake-up call for everyone. It shows that even well-known brands can have critical vulnerabilities. And when those flaws go unpatched, it's not just a technical problem—it's a real risk to your privacy and personal data.
OnePlus hasn't said when a fix will be available, but they're aware of the issue. In the meantime, keep an eye on official announcements and be cautious about what you install.
Your phone is a gateway to your digital life. Treat it that way, and stay informed.
