[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZySdPMUpmfLQOTQu4CS6wwwtTQv465dV77dgG55SIM8":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"b5ae1d6b-b07a-4953-a6ac-ea0c15cf7f5d","Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions","unpatched-oneplus-flaws-let-installed-android-apps-gain-root-without-permissions-7a9b3e","A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus's own software to gain root access, the highest level of control over an Android phone. OnePlus told him the same flaws affect many more of its own devices and those of OPPO, though it has not","Researcher Rasmus Moorats discovered two unpatched vulnerabilities in OnePlus's OxygenOS that allow a malicious, locally installed app to gain root access without requiring any user permissions. OnePlus confirmed the flaws affect multiple devices and those of OPPO, but has not disclosed which models. The company also clashed with Moorats over disclosure, asserting its right to control when and how vulnerabilities are made public, even threatening legal action.","Unpatched OnePlus flaws allow installed Android apps to gain root access without permissions.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Funpatched-oneplus-flaws-let-installed.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjiGu2guziH88Cs_LnFsPkCJ4zuxqgSX7q3SRrBXdSAEeJPhmYnpNp-c0WCNCqoOoyCv6NcnmCKm20rhqSb2rjw7KZ6Kh6UssR2fZG5SZX9Pjhb_fjONdBfgpxqpWNABPDvSmD9Hp913nErgH4PQm1ehlyspJt5RXASYckP6jHE3G0V2ou5fwkG7JOZyBY\u002Fs1600\u002Foneplus.jpg","2026-09-24T18:10:18+00:00","2026-09-24T20:01:05.33313+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"OxygenOS","product",{"name":21,"type":22},"OnePlus","vendor",{"name":24,"type":22},"OPPO",{"name":26,"type":19},"AtlasService",{"name":28,"type":19},"olc2","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[21,24,18],{"controls":50,"vendors":134},[51,79,105],{"slug":52,"name":53,"problem":54,"products":55},"patch-management","Automated patch management","Known holes get closed in days, not months.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":52,"product_name":76,"url":77,"description":78},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":80,"name":81,"problem":82,"products":83},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":101,"product_name":102,"url":103,"description":104},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":150},"unpatched-oxygenos-flaws-enable-root-access-without-user-permissions","Unpatched OxygenOS Flaws Enable Root Access Without User Permissions","Two unpatched vulnerabilities in OnePlus's OxygenOS allow locally installed malicious apps to silently escalate privileges to root level, bypassing Android's permission model entirely. This is critical because root access exposes the entire device — including credentials, communications, and sensitive data — without any user interaction or awareness. The situation is compounded by OnePlus's failure to promptly patch confirmed flaws and its aggressive stance toward the researcher who responsibly disclosed them. Vendor attempts to suppress or control vulnerability disclosure undermine the security community's ability to protect end users, and delays in patching leave millions of devices at risk. This case highlights that device manufacturers must treat privilege escalation vulnerabilities as critical-priority patches.",[140,141,142,143,144,145,146,147,148,149],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Controlled Use of Administrative Privileges","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST AC-6: Least Privilege","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","ISO\u002FIEC 27001: A.12.6.1 Management of Technical Vulnerabilities","OWASP Mobile Top 10: M1 - Improper Platform Usage","GDPR Article 32: Security of Processing (for organizations handling personal data on affected devices)",{"NIST AC-6: Least Privilege":151,"NIST SI-2: Flaw Remediation":152,"NIST RA-5: Vulnerability Monitoring and Scanning":153,"OWASP Mobile Top 10: M1 - Improper Platform Usage":154,"CIS Control 7: Continuous Vulnerability Management":155,"CIS Control 2: Inventory and Control of Software Assets":156,"CIS Control 4: Controlled Use of Administrative Privileges":157,"ISO\u002FIEC 27001: A.12.6.1 Management of Technical Vulnerabilities":158,"NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning":159,"GDPR Article 32: Security of Processing (for organizations handling personal data on affected devices)":160},"Least privilege is what the OxygenOS flaws break: apps escalating to root bypass Android's permission model, so organisations should limit sensitive data on unpatched devices.","Flaw remediation requires timely vendor patches; where OnePlus has not fixed confirmed flaws, organisations must apply compensating controls or restrict affected devices.","Monitoring for known vulnerabilities across the mobile fleet identifies which OnePlus devices remain exposed to the unpatched root flaws.","The OxygenOS flaws arise from misuse of platform permission mechanisms, letting apps bypass Android's security model to obtain root.","Tracking and pressing vendors on unpatched flaws, and applying mitigations meanwhile, addresses the delay in OnePlus fixing confirmed OxygenOS root vulnerabilities.","Controlling which apps can be installed on managed phones reduces the chance a malicious app reaches devices exposed to the OxygenOS privilege escalation flaws.","Restricting privileges matters here: the flaws let ordinary apps silently gain root, the opposite of the controlled privilege use this item calls for on managed devices.","Managing technical vulnerabilities means assessing exposure of mobile devices to the OxygenOS flaws and taking action, such as restricting use, until patches arrive.","Enterprise patch planning includes tracking vendor patch status for mobile devices and setting policy when a vendor like OnePlus is slow to fix confirmed flaws.","Where affected phones hold personal data, silent root access by malicious apps means appropriate security measures must include managing or restricting unpatched devices."]