A malicious app gained root on an unmodified OnePlus phone without asking for a single permission. OnePlus says the flaws affect Oppo devices too, but has not named every model. When the researcher reported the problem, he waited months for updates on the fixes and received a legal warning about publishing his findings.