← Wednesday, September 30, 2026SecurityVulnerability

Two OnePlus flaws let an untrusted app gain root with no special permissions

blog.nns.ee 12 min read Editor score 7/10

The author chained two issues to reach uid 0 with all Linux capabilities from an ordinary APK, then verified the exploit on a OnePlus 15. The write-up is a concrete example of how flaws combine to defeat a device’s app boundary.

What: Two OnePlus flaws can chain from an untrusted app with no special permissions to root with all Linux capabilities.
How: AtlasService accepts Binder calls without checking caller permissions; a specific setEvent triggers a listener that calls dumpsysAudioInfo.
Why it matters: The issues show how an exposed privileged system service can turn a plain app install into a device-wide privilege escalation.

An untrusted app reaches AtlasService, whose event handling starts a worker thread for audio information. Sketched from the article's own text.

Read on blog.nns.ee → Lobsters · 1 comments

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.