CVE-2026-70387

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork's and calls execl"/vendor/bin/sh", "sh", "-c", cmd, NULL with a caller-supplied command string. The only authorization check is...

CVE-2026-70386

Improper neutralization of special elements used in an OS command 'OS command injection' and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitra...

CVE-2026-70387

This vulnerability exists in OnePlus OxygenOS on Android due to an Exposed Dangerous Method and Incorrect Authorization in the olc2 logging HAL . The HAL exposes a binder method that forks and executes a shell command (execl) using a caller-supplied string. The system only verifies that the calli...

CVE-2026-70387 OnePlus OxygenOS exposed dangerous method vulnerability

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork's and calls execl"/vendor/bin/sh", "sh", "-c", cmd, NULL with a caller-supplied command string. The only authorization check is...

EUVD-2026-107155

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork's and calls execl"/vendor/bin/sh", "sh", "-c", cmd, NULL with a caller-supplied command string. The only authorization check is...

EUVD-2026-107149

Improper neutralization of special elements used in an OS command 'OS command injection' and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitra...

CVE-2025-10184: OnePlus OxygenOS Telephony provider permission bypass (FIXED as of October 11, 2025)

Overview Rapid7 has identified a permission bypass vulnerability in multiple versions of OnePlus OxygenOS installed on its Android smartphones, across multiple devices. It is expected that a wider range of devices than those tested are affected. When leveraged, the vulnerability allows any...

OnePlus OxygenOS security vulnerabilities

OnePlus OxygenOS is a smartphone operating system from Chinese company OnePlus. A security vulnerability exists in OnePlus OxygenOS, which stems from a lack of write access to multiple content providers and SQL injection in the update method of these providers, which could lead to the disclosure ...

OnePlus OxygenOS Local Security Bypass Vulnerability

The OnePlus 3 and 3T are both smartphones from China's OnePlus Technology OnePlus.OxygenOS is the operating system it comes with. A local security bypass vulnerability exists in OnePlus OxygenOS. An attacker can exploit the vulnerability to bypass security restrictions and perform unauthorized...