OnePlus OxygenOS 12-15 flaw lets apps read and send SMS, patch Oct

A software flaw in OnePlus phones running OxygenOS 12 through 15 could allow any installed app to read and, in some cases, send SMS and MMS messages without user permission, cybersecurity researchers said, leaving multifactor authentication codes and private texts potentially exposed. The vulnerability, tracked as CVE-2025-10184, was disclosed publicly this month by Rapid7 after the firm said its attempts to privately notify OnePlus went unanswered.

Rapid7 researchers found the problem in modifications OnePlus made to Android's Telephony package, which added exported content providers such as PushMessageProvider, PushShopProvider and ServiceNumberProvider. Those providers were assigned READ_SMS permissions but not the corresponding write protections, Rapid7 said. Because client-supplied inputs are not properly sanitized, attackers can perform blind SQL injection against the providers to infer and reconstruct SMS content one character at a time, the firm explained. The exploit can also be used to create or update rows, which in some scenarios would allow messages to be sent from the device.

The researchers confirmed the issue on OnePlus 8T and multiple OnePlus 10 Pro units...