From a regular APK to root on OnePlus

Article Rasmus Moorats shows how two OxygenOS vulnerabilities can be chained from an ordinary APK with no special permissions to uid 0 and, subsequently, the vendor_qti_init_shell SELinux domain. The chain was confirmed on OnePlus 15 running OxygenOS 16; OnePlus reported that multiple OnePlus and OPPO devices were affected, but did not provide a complete list.

• AtlasService command injection — Any UID could call AtlasService.setEvent() with the atlas_event_multimedia_audio_dumpsys event. The supplied value reached audioDumpInfo, which constructed system("chmod 777 " + value) without escaping, allowing commands to run as uid 0 in the dumpstate domain. No special application privileges were required.

• olc2 HAL shell execution — The vendor.oplus.hardware.olc2.IOplusLogCore/default HAL exposed doShell() and accepted calls from any process whose caller UID was 0. It executed /vendor/bin/sh -c and spawned the child in vendor_qti_init_shell, providing all Linux capabilities listed in the article, while SELinux still constrained the resulting access. On the tested OnePlus 15, the issues were fixed in build 16.0.10.500(EX01).

Article: https://blog.nns.ee/2026/09/24/oneplus_root/