CVE-2025-10184: Unpatched OnePlus Flaw Exposes SMS Data & Breaks MFA, PoC Available

CVE-2025-10184 is a critical permission bypass in OnePlus OxygenOS that lets any installed app read SMS/MMS messages and metadata without permission, user interaction, or consent, according to Rapid7. The flaw, introduced with OxygenOS 12 in 2021, could silently exfiltrate SMS data including MFA codes and other sensitive information, with a proof-of-concept showing extraction of recent SMS messages and MFA tokens.

The vulnerability has been confirmed on OnePlus 8T / KB2003 (OxygenOS 12) and OnePlus 10 Pro 5G / NE2213 (OxygenOS 14–15 builds), while OxygenOS 11 builds were not affected. Rapid7 notes that the issue affects a core Android component and could extend to other OnePlus devices running the specified OxygenOS versions, and the vulnerability also enables blind SQL injection via unsanitized inputs in the affected providers.

At disclosure, there was no vendor patch, and Rapid7 recommends installing trusted apps, switching from SMS-based MFA to authenticator apps, using end-to-end encrypted messaging where possible, and opting for in-app push notifications where feasible, according to Rapid7.