Ethical Hacking News
A recently discovered vulnerability in the OxygenOS operating system used by multiple versions of OnePlus phones allows any installed app to access SMS data and metadata without permission or user interaction. This poses a significant risk to OnePlus device owners, who may be unknowingly exposing their sensitive communication data to rogue apps.
A recent discovery by Rapid7 researchers found a critical security flaw in OxygenOS operating system. The vulnerability (CVE-2025-10184) allows any installed app to access SMS data and metadata without permission or user interaction. The problem arises from a change made by OnePlus in the stock Android Telephony package, which exposed content providers with no write permission for 'READ_SMS.' This lack of write permission enables "blind SQL injection" attacks to reconstruct SMS content from the device database. Affected devices include all versions of OxygenOS from 12 to 15, tested on OnePlus 8T and 10 Pro. OnePlus has acknowledged the issue and is investigating a patch, but users are advised to take precautions until then.
Unpatched Vulnerability in OxygenOS Operating System Allows Any Installed App to Access SMS Data and Metadata Without Permission or User Interaction, Raises Serious Security Concerns for OnePlus Device Owners.
A recent discovery by Rapid7 researchers has revealed a serious security flaw in the OxygenOS operating system used by multiple versions of OnePlus phones. The vulnerability, tracked as CVE-2025-10184, allows any installed app to access SMS data and metadata without requiring permission or user interaction. This poses a significant risk to OnePlus device owners, who may be unknowingly exposing their sensitive communication data to rogue apps.
The problem arises from a change made by OnePlus in the stock Android Telephony package, which introduced additional exported content providers such as PushMessageProvider, PushShopProvider, and ServiceNumberProvider. The manifest for these providers does not declare a write permission for 'READ_SMS,' leaving it open to any app by default, even those that don't have SMS permissions.
This lack of write permission allows "blind SQL injection" attacks that can reconstruct SMS content from the device database by bruteforcing it one character at a time. According to Rapid7, this is possible because exposed tables must already contain at least one row, so update() can return a non-zero "rows changed" result. The provider must allow insert() so an attacker can create a dummy row to operate on if the table is empty.
Additionally, the SMS table must be in the same SQLite database file because the injected subquery must be able to reference it. This means that even if an app doesn't have SMS permissions, it can still access and manipulate SMS data by exploiting this vulnerability.
The impact of this flaw extends beyond individual apps and devices, as it affects all versions of OxygenOS from 12 to the latest one (15), which is built on top of Android 15. Rapid7 researchers tested and confirmed vulnerability on OnePlus 8T and 10 Pro, running various OxygenOS versions and Telephony package numbers.
OnePlus has acknowledged the disclosure and stated that they have launched an investigation into the problem. However, it remains to be seen when a patch will be made available for affected devices. Until then, device owners are advised to keep the number of installed apps on their OnePlus device to a minimum, only trust reputable publishers, and switch from SMS-based two-factor authentication to OTP apps like Google Authenticator.
Furthermore, sensitive communications should only occur on end-to-end encrypted apps, as SMS isn't properly isolated on OnePlus devices. This highlights the importance of staying informed about security updates and patches for popular operating systems and apps.
The discovery of this vulnerability serves as a reminder that even seemingly secure operating systems can have hidden vulnerabilities waiting to be exploited. It underscores the need for constant vigilance and awareness among device owners and security professionals alike.
In conclusion, the unpatched flaw in OnePlus phones exposes SMS data to rogue apps, raising serious security concerns for device owners. As with any software vulnerability, it is essential to remain informed about updates and patches, and take proactive steps to protect sensitive data.
Related Information:
https://www.ethicalhackingnews.com/articles/Unpatched-Flaw-in-OnePlus-Phones-Exposes-SMS-Data-to-Rogue-Apps-ehn.shtml
https://www.bleepingcomputer.com/news/security/unpatched-flaw-in-oneplus-phones-lets-rogue-apps-text-messages/
https://tech-ish.com/2025/09/24/oxygenos-12-15-sms-bug-oneplus-silent/
https://nvd.nist.gov/vuln/detail/CVE-2025-10184
https://www.cvedetails.com/cve/CVE-2025-10184/
Published: Wed Sep 24 13:12:57 2025 by llama3.2 3B Q4_K_M
