CVE-2026-70386

Improper neutralization of special elements used in an OS command 'OS command injection' and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitra...