CVE-2026-70387: OnePlus OxygenOS exposed dangerous method vulnerability

Q: Which OxygenOS versions are affected?

Affected versions are 16.1.0 before 16.1.10.500, 16.0.0 before 16.0.5.1200, and 15.0.0 before 15.0.0.2000.

Q: What access does an attacker need to exploit this issue?

The vulnerable binder method only accepts callers whose UID is 0. However, SELinux policy permits a broad set of client domains to access the logging HAL, and the described related vulnerability can make the dumpstate domain reachable from an unprivileged app.

Q: What is the impact after successful exploitation?

A successful caller can supply an arbitrary shell command to a process that executes it through /vendor/bin/sh. The resulting shell transitions into the vendor_qti_init_shell SELinux domain, which has all Linux capabilities.

Published Oct 21, 2026

Updated

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendorqtiinitshell:s0 SELinux context via a policy typetransition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.

Affected Software

1 affected component

OnePlus OxygenOS>=16.1.0<16.1.10.500, >=16.0.0<16.0.5.1200, >=15.0.0<15.0.0.2000

Event History

Oct 21, 2026

CVE Published

via MITRE·09:07 AM

Data Sourced

via MITRE·09:07 AM

DescriptionWeakness

Frequently Asked Questions

Which OxygenOS versions are affected?

Affected versions are 16.1.0 before 16.1.10.500, 16.0.0 before 16.0.5.1200, and 15.0.0 before 15.0.0.2000.

What access does an attacker need to exploit this issue?

The vulnerable binder method only accepts callers whose UID is 0. However, SELinux policy permits a broad set of client domains to access the logging HAL, and the described related vulnerability can make the dumpstate domain reachable from an unprivileged app.

What is the impact after successful exploitation?

A successful caller can supply an arbitrary shell command to a process that executes it through /vendor/bin/sh. The resulting shell transitions into the vendor_qti_init_shell SELinux domain, which has all Linux capabilities.

CVE-2026-70387: OnePlus OxygenOS exposed dangerous method vulnerability

Affected Software

Event History

Frequently Asked Questions

Which OxygenOS versions are affected?

What access does an attacker need to exploit this issue?

What is the impact after successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which OxygenOS versions are affected?

What access does an attacker need to exploit this issue?

What is the impact after successful exploitation?