CVE-2017-8850

CVE-2017-8850 affects OnePlus One, X, 2, 3, and 3T devices, allowing attackers to install different operating systems (HydrogenOS over OxygenOS and vice versa) due to lenient updater-scripts and shared OTA verification keys. This medium-severity vulnerability (CVSS 5.9) can be exploited by Man-in-the-Middle attackers during the unencrypted update process or by physical attackers using adb sideload. The potential impact involves exploiting vulnerabilities patched in one OS but not the other, and expanding the attack surface. There is no evidence of active exploitation, nor are there known public exploit codes like Metasploit or ExploitDB, though it has received some community discussion.