OnePlus/OPPO root privilege-escalation chain (AtlasService + olc2)

Preconditions / Affected

The chain is purely local: a malicious app must already be installed and running on the device — it cannot be triggered over the network. Once present, the app needs no permissions and shows no prompt. Confirmed working on a stock (unmodified) OnePlus 15 and an older OnePlus 12 Pro; Moorats expects the flaws across OxygenOS 16 generally, and OnePlus told him OPPO devices on the shared OxygenOS codebase are affected too (it did not name which). No CVE assigned and no OnePlus advisory naming the flaws existed at disclosure. No evidence of in-the-wild exploitation.

What to do

No patch existed at publication (Sept 24, 2026). The only practical defense the page states is to block the attack's entry condition: install apps only from sources you trust, since the chain cannot start without a malicious app on the device.

Caveats

OnePlus's disclosure timeline shows the fix gap concretely — reported April 18, confirmed May 20, an update June 22 with agreement to hold until Sept 17, then silence to requests on July 20 and Sept 11. Note the vendor's disputed stance: it claims "the exclusive final right of vulnerability disclosure" and says researchers may not publish full technical details even after a fix ships — so a future patch may not come with the detail needed to verify remediation.