OS Command Injection and Authorization Flaws in OnePlus OxygenOS

CVE-2026-70386

What is CVE-2026-70386?

The vulnerability stems from improper handling of special elements in OS commands within OnePlus's OxygenOS. An attacker can exploit the atlasservice binder interface, which inappropriately accepts inputs from any caller without the necessary authorization checks. This allows locally installed applications, without declared permissions and minimal user interaction, to execute arbitrary shell commands with root privileges. The flawed event handler, which processes user-supplied values unsafely, further exacerbates the issue, permitting the invocation of system services that can manipulate critical properties, leading to severe implications for device security.

References