OnePlus leaves OxygenOS root flaws unpatched for six months

Researcher Rasmus Moorats disclosed two unpatched OxygenOS flaws that let an app requesting zero permissions gain root access on the OnePlus 15 and likely many other OnePlus, OPPO and realme devices. The flaws were reported on April 18, 2026, confirmed by OnePlus in May, but no fix has shipped.

• Zero-permission app gains root on OnePlus 15 via two OxygenOS flaws
• Flaws reported April 18, 2026; still unpatched nearly six months later
• OnePlus confirmed the issues in May and claimed sole disclosure rights
• Attack confirmed on OnePlus 12; all of OxygenOS 16 suspected