TI-2025-09349 Aliases CVE-2025-10184 GHSA-q9jj-p5hc-gfmj

OnePlus OxygenOS Telephony provider permission bypass

HIGH 69CWE-862Published 2025-09-23 · Updated 2025-09-23

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass, SQL injection
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862 and CWE-89.

Summary

The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is also not notified that SMS data is being accessed. This could lead to sensitive information disclosure and could effectively break the security provided by SMS-based Multi-Factor Authentication (MFA) checks. The root cause is a combination of missing permissions for write operations in several content providers (com.android.providers.telephony.PushMessageProvider, com.android.providers.telephony.PushShopProvider, com.android.providers.telephony.ServiceNumberProvider), and a blind SQL injection in the update method of those providers.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.05083 92nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OnePlus	OxygenOS	all versions; all versions; all versions; all versions	—	No fix listed	CNA

OxygenOS VendorOnePlus Affected all versions; all versions; all versions; all versions Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-10184
2026-10-03 Alias added: GHSA-q9jj-p5hc-gfmj
2026-10-13 EPSS moved to the 90th–95th percentile

References

Exploit 1

https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/bltd4b7439a28b6c866/68d168a6930d015d43a6b588/CVE-2025-10184_PoC.zip

Advisory 1

https://www.rapid7.com/blog/post/cve-2025-10184-oneplus-oxygenos-telephony-provider-permission-bypass-not-fixed/

TI-2026-78560 OnePlus OxygenOS improper neutralization of special elements vulnerability CVSS 4.0HIGH 8.5
TI-2017-03628 OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands… CVSS 3.0CRITICAL 9.8
TI-2017-03626 An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. CVSS 3.0CRITICAL 9.8
TI-2017-08167 The OnePlus 2 Primary Bootloader (PBL) does not validate the SBL1 partition before… CVSS 3.0CRITICAL 9.8
TI-2023-11464 A remote code execution vulnerability in the webview component CVSS 3.1CRITICAL 9.8
TI-2017-03568 An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. CVSS 3.0HIGH 8.1

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences