OnePlus OxygenOS Vulnerability Lets Apps Access SMS Data Without User Permission

A newly disclosed flaw in OnePlus OxygenOS lets any app on a device read SMS and MMS messages without asking the user, tracked as CVE-2025-10184. The issue stems from a permission bypass in the Telephony content provider (com.android.providers.telephony), where core internal providers grant open access by default, allowing apps to query message data and metadata with no consent or notification.

CVE-2025-10184 affects OxygenOS 12, 14 and 15, and Rapid7 researchers confirmed the flaw on OnePlus 8T (OxygenOS 12, build KB2003_11_C.33) and OnePlus 10 Pro 5G (OxygenOS 15, builds NE2213_15.0.0.502 and NE2213_15.0.0.901). According to Rapid7, an investigation is underway and no security update schedule has been announced yet, leaving users exposed until a patch is released.

The advisory notes that a blind SQL injection vulnerability in the ServiceNumberProvider’s update method could let malicious apps infer SMS content one character at a time, bypassing READ_SMS enforcement.