A serious security vulnerability in OnePlus smartphones allows any installed application to access text messages and SMS metadata without requesting user permission or interaction. The flaw affects millions of devices worldwide running OxygenOS versions 12 through 15.

## The Vulnerability Details

Security researchers at Rapid7 discovered the vulnerability, designated CVE-2025-10184, which stems from modifications OnePlus made to Android’s standard messaging system. The company added custom content providers (PushMessageProvider, PushShopProvider, and ServiceNumberProvider) to their Telephony package but failed to properly secure them.

The critical oversight lies in the permission settings: while read permissions for SMS are correctly configured, write permissions are not, creating a dangerous security gap. This allows malicious apps to exploit the system through “blind SQL injection” attacks, reconstructing SMS content character by character from the device database.

## Affected Devices and Scope

The vulnerability impacts all OnePlus devices running OxygenOS versions 12 through 15, including:
– OnePlus 8T
– OnePlus 10 Pro 5G
– Potentially all other OnePlus models with these OS versions

Rapid7 researchers confirmed the flaw exists across multiple software builds and noted that the issue affects core Android components modified by OnePlus, making it a widespread problem rather than hardware-specific.

## Company Response and Timeline

Despite multiple attempts to contact OnePlus between May and August 2024, the company initially failed to respond to Rapid7’s security disclosure. After seven unsuccessful communication attempts, Rapid7 publicly released the vulnerability details and proof-of-concept exploit code.

Following the public disclosure, OnePlus finally acknowledged the issue and launched an investigation. In a September update, the company confirmed they have developed a fix and plan to roll it out globally starting mid-October 2024.

## User Protection Recommendations

Until the official patch is available, OnePlus users should:

– **Minimize app installations** – Only install apps from trusted, reputable publishers
– **Switch authentication methods** – Replace SMS-based two-factor authentication with authenticator apps like Google Authenticator
– **Use encrypted messaging** – Conduct sensitive communications through end-to-end encrypted apps rather than SMS
– **Stay vigilant** – Monitor app permissions and behavior for suspicious activity

## The Bigger Picture

This vulnerability highlights the security risks that can arise when manufacturers modify core Android components without proper security review. OnePlus’s failure to respond promptly to security researchers also raises concerns about the company’s commitment to user security and responsible disclosure practices.

The incident serves as a reminder for users to carefully consider the security implications of their device choices and for manufacturers to prioritize security in their software customizations.