Live › vulnerability › CVE-2026-70386
Go to dashboardOnePlus's atlasservice binder accepts events from any app without authorization, and one handler passes a caller-supplied value into a root shell command. A locally installed Android app with no permissions can run arbitrary shell commands as root (uid 0).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Owners of OnePlus phones running the affected OxygenOS builds are exposed, since any app installed on the device can use the flaw without asking for permissions. Fleet owners managing OnePlus Android devices should inventory builds; devices on other Android vendors and patched OxygenOS builds are not affected.
No product ranges from the sources yet.
16.1.0 to before 16.1.10.500, 16.0.0 to before 16.0.5.1200, and 15.0.0 to before 15.0.0.2000.16.1.10.500, 16.0.5.1200, or 15.0.0.2000 or later, depending on the release line in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects combine: (a) OnePlus's atlasservice binder interface accepts setEvent(String8 name, String8 value) from any caller without authorization, and (b) one event handler (OplusAtlasLogWriter::handleEvent, matching event name atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value into the system property oplus.audio.dumpinfo.type and starts the root init service audiodumpinfo, which passes that property value unsanitized to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
This page as .md · .json · in your agent: get_signal("CVE-2026-70386")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.