OnePlus AtlasService and olc2 Chain Grants Permissionless Root on Stock OxygenOS 16

Moorats reported both flaws on 18 April 2026. OnePlus confirmed them on 20 May, asserted exclusive control over disclosure timing, and threatened legal action if technical details were published without consent. The company cited European cybersecurity rules as justification while scheduling an internal fix that had not shipped by 24 September. The first flaw lets any installed app invoke a root-owned service that pipes attacker-controlled text into a system command inside the dumpstate zone. The second flaw, reachable only after the first succeeds, executes arbitrary shell commands inside a higher-privilege context, enabling kernel module loading.