A critical vulnerability in OnePlus Android devices has been discovered, allowing installed apps to gain root access without needing explicit permissions. This flaw affects users of OnePlus smartphones running version 11 and above, with an estimated 100 million devices exposed.
The issue lies in a misconfigured component called “Map cross-domain privilege escalation,” which allows malicious apps to bypass traditional security checks and elevate their privileges to root level. This means that even if an app has been granted limited permissions by the user, it can exploit this vulnerability to gain unfettered access to sensitive areas of the device.
OnePlus devices use a unique system called “cross-domain privilege escalation” to manage permissions between different apps and system components. The misconfiguration in question allows malicious apps to map their own domain to the root domain, thereby gaining elevated privileges. This creates an “active attack path,” which is a route that can be exploited by attackers to gain access to sensitive data or perform unauthorized actions.
The problem is that this vulnerability is not just limited to malicious apps; even legitimate apps installed on the device can exploit it if they are designed with malicious intent. This highlights the importance of keeping software up-to-date and only installing trusted applications from reputable sources.
This issue has significant implications for users, as it allows attackers to gain unfettered access to sensitive areas of the device. With root privileges, an attacker can modify system files, install malware, or even steal sensitive data such as passwords and credit card numbers. The fact that this vulnerability is unpatched in current versions of OnePlus devices means that users are exposed to a serious security risk.
To mitigate this risk, OnePlus has announced plans to release patches for affected devices. In the meantime, users can take steps to protect themselves by keeping their device’s software up-to-date and only installing trusted applications from reputable sources. It is also essential to monitor app behavior closely and remove any suspicious or unauthorized apps as soon as possible.
Practically speaking, users should be cautious when downloading and installing new apps on their OnePlus devices, especially if they are not familiar with the developer or the app’s functionality. By being vigilant and taking proactive steps to protect themselves, users can minimize the risk of falling victim to this vulnerability.
Source: The Hacker News — 2026-09-24