[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4RMsFgAt28twCK5KlgIFls7Lpghkbq_9a-hGiBuLxbY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":33,"created_at":34,"published_at":35,"article":36,"tags":40,"podcasts":59,"controls":60},"ee71ef2a-6069-4b07-8aa5-beb3b4399800","unpatched-oxygenos-flaws-enable-root-access-without-user-permissions","b5ae1d6b-b07a-4953-a6ac-ea0c15cf7f5d","Unpatched OxygenOS Flaws Enable Root Access Without User Permissions","Two unpatched vulnerabilities in OnePlus's OxygenOS allow locally installed malicious apps to silently escalate privileges to root level, bypassing Android's permission model entirely. This is critical because root access exposes the entire device — including credentials, communications, and sensitive data — without any user interaction or awareness. The situation is compounded by OnePlus's failure to promptly patch confirmed flaws and its aggressive stance toward the researcher who responsibly disclosed them. Vendor attempts to suppress or control vulnerability disclosure undermine the security community's ability to protect end users, and delays in patching leave millions of devices at risk. This case highlights that device manufacturers must treat privilege escalation vulnerabilities as critical-priority patches.","**Immediate actions:**\n- Avoid installing untrusted or sideloaded apps on affected OnePlus\u002FOPPO devices until patches are released.\n- Monitor official OnePlus\u002FOPPO security bulletins and apply firmware updates immediately upon release.\n- Consider restricting affected devices from accessing sensitive corporate resources until the vulnerabilities are remediated.\n\n**Long-term improvements:**\n- Establish a formal mobile device management (MDM) policy that enforces OS patch compliance across all managed endpoints.\n- Maintain a complete inventory of mobile device models and OS versions to rapidly assess exposure when new vulnerabilities are disclosed.\n- Evaluate vendor security responsiveness and patch cadence as part of device procurement and supply chain risk assessments.\n\n**Detection measures:**\n- Deploy mobile threat defense (MTD) solutions capable of detecting anomalous privilege escalation behavior on Android devices.\n- Enable audit logging for device management events and alert on unexpected root or elevated-privilege activity.\n- Monitor threat intelligence feeds for proof-of-concept exploit releases tied to unpatched mobile OS vulnerabilities.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Controlled Use of Administrative Privileges","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST AC-6: Least Privilege","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","ISO\u002FIEC 27001: A.12.6.1 Management of Technical Vulnerabilities","OWASP Mobile Top 10: M1 - Improper Platform Usage","GDPR Article 32: Security of Processing (for organizations handling personal data on affected devices)",{"NIST AC-6: Least Privilege":23,"NIST SI-2: Flaw Remediation":24,"NIST RA-5: Vulnerability Monitoring and Scanning":25,"OWASP Mobile Top 10: M1 - Improper Platform Usage":26,"CIS Control 7: Continuous Vulnerability Management":27,"CIS Control 2: Inventory and Control of Software Assets":28,"CIS Control 4: Controlled Use of Administrative Privileges":29,"ISO\u002FIEC 27001: A.12.6.1 Management of Technical Vulnerabilities":30,"NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning":31,"GDPR Article 32: Security of Processing (for organizations handling personal data on affected devices)":32},"Least privilege is what the OxygenOS flaws break: apps escalating to root bypass Android's permission model, so organisations should limit sensitive data on unpatched devices.","Flaw remediation requires timely vendor patches; where OnePlus has not fixed confirmed flaws, organisations must apply compensating controls or restrict affected devices.","Monitoring for known vulnerabilities across the mobile fleet identifies which OnePlus devices remain exposed to the unpatched root flaws.","The OxygenOS flaws arise from misuse of platform permission mechanisms, letting apps bypass Android's security model to obtain root.","Tracking and pressing vendors on unpatched flaws, and applying mitigations meanwhile, addresses the delay in OnePlus fixing confirmed OxygenOS root vulnerabilities.","Controlling which apps can be installed on managed phones reduces the chance a malicious app reaches devices exposed to the OxygenOS privilege escalation flaws.","Restricting privileges matters here: the flaws let ordinary apps silently gain root, the opposite of the controlled privilege use this item calls for on managed devices.","Managing technical vulnerabilities means assessing exposure of mobile devices to the OxygenOS flaws and taking action, such as restricting use, until patches arrive.","Enterprise patch planning includes tracking vendor patch status for mobile devices and setting policy when a vendor like OnePlus is slow to fix confirmed flaws.","Where affected phones hold personal data, silent root access by malicious apps means appropriate security measures must include managing or restricting unpatched devices.","published","2026-09-24T20:20:43.829555+00:00","2026-09-24T20:20:43.247+00:00",{"id":7,"url":37,"slug":38,"title":39},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Funpatched-oneplus-flaws-let-installed.html","unpatched-oneplus-flaws-let-installed-android-apps-gain-root-without-permissions-7a9b3e","Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions",[41,47,53],{"id":42,"name":43,"slug":44,"description":45,"color":46},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":48,"name":49,"slug":50,"description":51,"color":52},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":54,"name":55,"slug":56,"description":57,"color":58},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[61,64,68],{"slug":56,"name":62,"problem":63},"Automated patch management","Known holes get closed in days, not months.",{"slug":65,"name":66,"problem":67},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":69,"name":70,"problem":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]