OnePlus 15 Devices Vulnerable to Root Exploit via Unprivileged Apps

A new report from The Hacker News reveals that an unpatched flaw in OnePlus devices allows a malicious application installed through Google Play or sideloaded to acquire root privileges with zero user‑requested permissions. The vulnerability was discovered by security researcher Rasmus Moorats and involves chaining two separate weaknesses—one in the bootloader’s signature verification process and another in the device’s SELinux policy enforcement—to bypass mandatory access controls (MAC) and execute code at kernel level, giving attackers complete system control over any OnePlus 15 running OxygenOS.¹

OnePlus confirmed that the same defects exist across many other models—including those manufactured for OPPO—and are present in all current releases of OxygenOS. No official patch has been issued yet; the company is reportedly working on a fix but none released. Until then every device remains susceptible to the same privilege escalation vector.¹

Root access lets attackers read or modify data stored on the device, install additional malware, tamper with system services, and exfiltrate personal information unnoticed.

The exploit mirrors earlier Android attacks such as MWRoot on Samsung Galaxy S3 around 2014 that leveraged kernel vulnerabilities before Knox was hardened, enabling similar root privileges. Such legacy flaws underline how insufficient sandboxing or inter‑process communication validation can create dangerous backdoors even when apps request no special permissions.

Security specialists note this case falls into classic privilege escalation exploits where trusted computing base components—bootloaders, SELinux policies, or other low‑level mechanisms—are misconfigured or inadequately protected. When these foundational elements fail, benign applications can trigger privileged code paths and gain full control over the operating system.

This mirrors past incidents where seemingly harmless apps were used as stepping stones to reach deeper OS layers.

The report also highlights why Google Play Integrity API remains critical; it verifies only vetted, signed applications run with elevated rights. Because malicious actors can sideload unsigned APKs, users should be cautious about installing any app from outside official channels, especially if their device has not yet received latest OxygenOS update. The OnePlus vulnerability underscores that even standard user‑grade apps can become powerful tools for attackers when underlying platform checks are weak.

In conclusion, Moorats’ discovery demonstrates unpatched bootloader and SELinux policy flaws enable root access on OnePlus phones without explicit permission requests. Until an official fix arrives, all OnePlus devices running current OxygenOS versions remain at risk of complete system compromise, potentially exposing personal data alike.