CVE-2026-70387

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork's and calls execl"/vendor/bin/sh", "sh", "-c", cmd, NULL with a caller-supplied command string. The only authorization check is...

CVE-2026-70386

Improper neutralization of special elements used in an OS command 'OS command injection' and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitra...

CVE-2026-70387

This vulnerability exists in OnePlus OxygenOS on Android due to an Exposed Dangerous Method and Incorrect Authorization in the olc2 logging HAL . The HAL exposes a binder method that forks and executes a shell command (execl) using a caller-supplied string. The system only verifies that the calli...

EUVD-2026-107155

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork's and calls execl"/vendor/bin/sh", "sh", "-c", cmd, NULL with a caller-supplied command string. The only authorization check is...

CVE-2026-70387 OnePlus OxygenOS exposed dangerous method vulnerability

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork's and calls execl"/vendor/bin/sh", "sh", "-c", cmd, NULL with a caller-supplied command string. The only authorization check is...

CVE-2026-70387 OnePlus OxygenOS exposed dangerous method vulnerability

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork's and calls execl"/vendor/bin/sh", "sh", "-c", cmd, NULL with a caller-supplied command string. The only authorization check is...

EUVD-2026-107149

Improper neutralization of special elements used in an OS command 'OS command injection' and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitra...

CVE-2026-70386 OnePlus OxygenOS improper neutralization of special elements vulnerability

Improper neutralization of special elements used in an OS command 'OS command injection' and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitra...

PT-2026-120508

Name of the Vulnerable Software and Affected Versions OnePlus OxygenOS versions 16.1.0 through 16.1.10.499 OnePlus OxygenOS versions 16.0.0 through 16.0.5.1199 OnePlus OxygenOS versions 15.0.0 through 15.0.0.1999 Description An OS command injection and missing authorization issue exists in OnePlu...

PT-2026-120514

Name of the Vulnerable Software and Affected Versions OnePlus OxygenOS versions 16.1.0 through 16.1.10.499 OnePlus OxygenOS versions 16.0.0 through 16.0.5.1199 OnePlus OxygenOS versions 15.0.0 through 15.0.0.1999 Description An incorrect authorization issue exists in the olc2 logging HAL, which...

OnePlus OxygenOS command injection vulnerability

A security vulnerability exists in OnePlus OxygenOS versions prior to 16.1.0 through 16.1.10.500, 16.0.0 through 16.0.5.1200, and 15.0.0 through 15.0.0.2000. This vulnerability arises because the atlasservice binder interface permits unauthorized acceptance of setEvent calls. Additionally, the...

CVE-2025-10184: OnePlus OxygenOS Telephony provider permission bypass (FIXED as of October 11, 2025)

Overview Rapid7 has identified a permission bypass vulnerability in multiple versions of OnePlus OxygenOS installed on its Android smartphones, across multiple devices. It is expected that a wider range of devices than those tested are affected. When leveraged, the vulnerability allows any...

OnePlus OxygenOS security vulnerabilities

OnePlus OxygenOS is a smartphone operating system from Chinese company OnePlus. A security vulnerability exists in OnePlus OxygenOS, which stems from a lack of write access to multiple content providers and SQL injection in the update method of these providers, which could lead to the disclosure ...

OnePlus OxygenOS Local Security Bypass Vulnerability

The OnePlus 3 and 3T are both smartphones from China's OnePlus Technology OnePlus.OxygenOS is the operating system it comes with. A local security bypass vulnerability exists in OnePlus OxygenOS. An attacker can exploit the vulnerability to bypass security restrictions and perform unauthorized...