CVE-2025-10184: OnePlus OxygenOS Telephony provider permission bypass
The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is also not notified that SMS data is being accessed. This could lead to sensitive information disclosure and could effectively break the security provided by SMS-based Multi-Factor Authentication (MFA) checks.
The root cause is a combination of missing permissions for write operations in several content providers (com.android.providers.telephony.PushMessageProvider, com.android.providers.telephony.PushShopProvider, com.android.providers.telephony.ServiceNumberProvider), and a blind SQL injection in the update method of those providers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10184?
The severity of CVE-2025-10184 is high due to the unauthorized access to sensitive SMS/MMS data.
How do I fix CVE-2025-10184?
To fix CVE-2025-10184, ensure your OnePlus OxygenOS is updated to the latest security patch provided by OnePlus.
Which devices are affected by CVE-2025-10184?
CVE-2025-10184 primarily affects devices running OnePlus OxygenOS.
What type of data can be accessed through CVE-2025-10184?
CVE-2025-10184 allows access to SMS/MMS data and metadata without user consent or notification.
Is user interaction required for CVE-2025-10184 to exploit?
No, CVE-2025-10184 does not require user interaction for the exploitation, allowing silent data access.