OxygenOS vulnerabilities

3 known vulnerabilities in OxygenOS from OnePlus. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.4 High severity

  OxygenOS: Exposed Dangerous Method or Function

  CVE-2026-70387Oct 21, 2026OnePlus

  Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command st

• 8.5 High severity

  OxygenOS: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-70386Oct 21, 2026OnePlusEPSS 1.38%

  Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction b

• 8.2 High severity

  OxygenOS: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-10184Sep 23, 2025OnePlusEPSS 5.38%

  The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is also not notified that SMS data is being accessed. This