Post #23391 96 Sep 24, 2026, 12:06 UTC Getting root on OnePlus 15 from an untrusted app, via an audio debug service and a vendor HALhttps://blog.nns.ee/2026/09/24/oneplus-root/@secharvester nns.ee Getting root on OnePlus 15 from an untrusted app, via an audio debug service and a vendor HAL | nns.ee Chaining an AtlasService binder command injection and an olc2 HAL binder method into uid 0 with all Linux capabilities from a plain installable app on OxygenOS 16.