TelephonyProvider

Unpatched OnePlus flaw lets rogue apps access SMS data, Rapid7 says

News, Privacy, Risk, Vendors, Vulnerabilities

September 24, 2025

Rapid7 has disclosed an unpatched vulnerability in OnePlus OxygenOS that could allow rogue apps to access SMS data and metadata without user interaction, due to exposed content providers in the Telephony package. The flaw, CVE-2025-10184, affects OxygenOS 12 through 15 and remains unpatched as OnePlus investigates; a PoC exploit has been published.