OxygenOS vulnerabilities
CVEs whose affected-version data names the OxygenOS package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-70386High· 8.5OnePlus OxygenOS improper neutralization of special elements vulnerability
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared a…
▾ TwilightOnePlus · OxygenOSvia CVEORG
CVE-2026-70387High· 8.4OnePlus OxygenOS exposed dangerous method vulnerability
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a cal…
▾ TwilightOnePlus · OxygenOSvia CVEORG