If your OnePlus phone is feeling a little too trusting lately, there’s a reason: a pair of baked-in bugs lets a dodgy app quietly escalate itself to root access without permissions. In plain speak — an app you install (no scary permission pop-ups required) can take over the phone’s deepest settings on several recent OnePlus builds.

What happened (in plain, mildly dramatic terms)

A security researcher discovered two flaws in OnePlus’s shipped software that, when used together, hand an installed app more control than it should have. The first problem lives in a OnePlus system component that gathers debug info and will accept calls from any app without verifying the caller. That component forwards text into a system command without proper checks, giving the app limited root powers inside a constrained system area.

The second flaw is a separate helper service that runs hardware-related commands. It will execute arbitrary shell instructions as long as the caller already has root inside that constrained area — which the first bug provides. Patch the two together and the app moves from restricted root to full system-level control, including low-level Linux privileges.

Important practical notes: the attack is local, meaning a malicious app must already be installed on the phone. It does not need any special Android permissions, and there’s no user prompt. The researcher reproduced the chain on a stock OnePlus 15 and also confirmed it on an older OnePlus 12 Pro. OnePlus says the same issues affect multiple devices (and sibling-brand devices that share software).

Timeline, fallout, and what you can do right now

The researcher reported the issues to OnePlus and engaged in months of back-and-forth before publishing his findings. OnePlus acknowledged the bugs and said a fix was planned, but also warned the researcher about disclosing details publicly and hinted at possible legal action if he released the write-up early. When the company hadn’t shipped a fix, the researcher published his report.

  • April: flaws reported to the vendor.
  • May: vendor confirmed the issues and asserted control over disclosure.
  • June: an update and a requested embargo were agreed on, with a later deadline.
  • Summer to early fall: the researcher asked for status updates and received little or no reply.
  • Late September: the researcher went public when no patch had arrived.

At the time of disclosure there was no public fix or assigned CVE, and there’s no proof the bugs were used in the wild. So what can you do?

  • Only install apps from sources you trust (the attack needs a malicious app already present).
  • Watch for official updates from your phone maker and apply patches as soon as they appear.
  • Consider minimizing installed apps and removing anything you don’t recognize or use.

In short: don’t panic, but be picky. Until OnePlus (and its sibling brands) ships a patch, the safest move is to be stingy with installs and keep an eye on official updates.