A simple app can root OnePlus and Oppo phones without any special permissions

A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions, reports The Hacker News (September 24).

Two flaws chained by a researcher

Researcher Rasmus Moorats chained two vulnerabilities in OnePlus's own software to gain root access — the highest level of control over an Android phone. French outlet Frandroid relayed the story on September 28.

A wider scope than expected

OnePlus told the researcher the same flaws affect many more of its own devices, as well as those of Oppo, without saying which. The company confirmed both flaws back in May, but reserves the right to decide when to disclose them.

Until a fix ships, the safe move is to install apps only from official stores and keep an eye on security updates.

Source: The Hacker News — Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions