Getting root on OnePlus 15 from an untrusted app, via an audio debug service and a vendor HAL | nns.ee
blog.nns.ee
Chaining an AtlasService binder command injection and an olc2 HAL binder method into uid 0 with all Linux capabilities from a plain installable app on OxygenOS 16.