![\"Unpatched](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/OnePlus.png\")
<\/p>\n<\/p>\n
A vulnerability in multiple versions of OxygenOS, the Android-based operating system from OnePlus, allows any installed app to access SMS data and metadata without requiring permission or user interaction.<\/p>\n
OnePlus, a subsidiary of Oppo, is a Shenzhen-based consumer electronics maker known for developing high-end smartphones at competitive pricing. While other major Chinese brands like Huawei and Xiaomi aren\u2019t available in the U.S., OnePlus devices are officially available in the country.<\/p>\n
The flaw, tracked as CVE-2025-10184, and discovered by Rapid7 researchers<\/a>, is currently unpatched and exploitable. The Chinese OEM failed to respond to Rapid7\u2019s disclosures to this day, and the cybersecurity company published the technical details along with a proof-of-concept (PoC) exploit.<\/p>\n Source of the problem<\/p>\n The problem arises from OnePlus changing the stock Android Telephony package to introduce additional exported content providers like PushMessageProvider, PushShopProvider, and ServiceNumberProvider.<\/p>\n The manifest for these providers does not declare a write permission for \u2018READ_SMS,\u2019 leaving it open to any app by default, even those that don\u2019t have SMS permissions.<\/p>\n To make matters worse, client-supplied inputs aren\u2019t sanitized, allowing \u201cblind SQL injection\u201d that could reconstruct SMS content from the device database, bruteforcing it one character at a time.<\/p>\n \u201cBy using an algorithm to repeat this process for each character in each row returned by the sub query, it\u2019s possible to exfiltrate the database content, using the return value from the update method as an indicator of true\/false,\u201d describes Rapid7 in the report<\/a>.<\/p>\n So, while the read permission for SMS is correctly set, the write permission isn\u2019t, allowing the inference of SMS content when certain prerequisites are met:\u00a0<\/p>\n Exposed table must already contain at least one row, so update() can return a non-zero \u201crows changed\u201d result.
Impact and response<\/p>\n The issue impacts all versions of OxygenOS from 12 to the latest one, which is 15, which is the latest, built on top of Android 15.<\/p>\n Rapid7 researchers tested and confirmed vulnerability on OnePlus 8T and 10 Pro, running various OxygenOS versions and Telephony package numbers, but noted that their list is almost definitely non-exhaustive.<\/p>\n \u201cWhile the build numbers above [on the table] are specific to the test devices, as the issue affects a core component of Android, we expect this vulnerability to affect other OnePlus devices running the above versions of OxygenOS, i.e., it does not seem to be a hardware-specific issue,\u201d explained Rapid7.<\/p>\n Device \/ Model
The researchers tried to contact OnePlus to share their findings on May 1 and followed\u00a0up on alternative email addresses multiple times until August 16.<\/p>\n After receiving no response to seven separate communication attempts, the security firm publicly disclosed the details for CVE-2025-10184.<\/p>\n Shortly after publication of Rapid7’s report, OnePlus acknowledged the disclosure and said they have launched an investigation into the problem.<\/p>\n BleepingComputer has contacted OnePlus to request a comment, but we are still awaiting a response.<\/p>\n Until a patch is made available, it is recommended to keep the number of installed apps on your OnePlus device to a minimum, only trust reputable publishers, and switch from SMS-based two-factor authentication to OTP apps like Google Authenticator.<\/p>\n Since SMS isn\u2019t properly isolated on OnePlus devices, sensitive communications should only occur on end-to-end encrypted apps.<\/p>\n![\"Extra](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/providers.jpg\")
Extra providers OnePlus added on its Telephony package
Source: Rapid7<\/p>\n
\n\tThe provider must allow insert() so an attacker can create a dummy row to operate on if the table is empty.
\n\tThe sms table must be in the same SQLite database file because the injected subquery must be able to reference it.
<\/p>\n![\"PoC](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/poc.jpg\")
PoC exploit to infer SMS content
Source: Rapid7<\/p>\n
\n\t\t\tPackage version
\n\t\t\tOxygenOS version
\n\t\t\tBuild Number
\n\t\tOnePlus 8T \/ KB2003
\n\t\t\t3.4.135
\n\t\t\t12
\n\t\t\tKB2003_11_C.3
\n\t\tOnePlus 10 Pro 5G \/ NE2213
\n\t\t\t14.10.30
\n\t\t\t14
\n\t\t\tNE2213_14.0.0.700(EX01)
\n\t\tOnePlus 10 Pro 5G \/ NE2213
\n\t\t\t15.30.5
\n\t\t\t15
\n\t\t\tNE2213_15.0.0.502(EX01)
\n\t\tOnePlus 10 Pro 5G \/ NE2213
\n\t\t\t15.30.10
\n\t\t\t15
\n\t\t\tNE2213_15.0.0.700(EX01)
\n\t\tOnePlus 10 Pro 5G \/ NE2213
\n\t\t\t15.40.
\n\t\t\t15
\n\t\t\tNE2213_15.0.0.901(EX01)
<\/p>\n
![\"Picus](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/08\/blue-report-2025.jpg\")
<\/a><\/p>\n