A researcher has discovered and chained two unpatched flaws in OnePlus’s OxygenOS that allow a malicious Android app to gain root access without requiring any special permissions. These vulnerabilities, confirmed by OnePlus to affect many of its devices and those of OPPO, enable an installed app to achieve the highest level of control over the phone. Users are currently vulnerable to apps leveraging these flaws until patches are released.