Loading story…
A high-severity flaw in the preinstalled com.oneplus.account app on OnePlus 13R devices allows any installed malicious app to obtain an authenticated OnePlus Cloud session token. The exported OPAccountProvider content provider relies on com.oneplus.account.READ_ACCOUNT_INFO, a permission that third-party apps can declare because it is not restricted to software signed by OnePlus; an app can then invoke get_account_oneplus_token to retrieve oldSecondaryToken without user interaction beyond installation.
The exposed token was accepted by the OnePlus Cloud API and was demonstrated to enable modification of victim account data, creating a path to account session takeover. Doyensec confirmed the token exposure remained in firmware CPH2691_16.0.10.500(EX01) and disclosed the issue publicly after OnePlus had not remediated it.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Doyensec publicly disclosed the unresolved OnePlus 13R OEM-app vulnerability, describing how a malicious installed app could obtain an authenticated OnePlus Cloud token without user interaction and impersonate the victim in cloud services.
Doyensec confirmed that an untrusted app could still extract a OnePlus account token from OPAccountProvider and that the token remained accepted by the OnePlus Cloud API. The researchers could not reproduce the prior account-data modification on the latest firmware because of regional-mechanism changes, but the underlying token exposure persisted.
A $720 bug bounty was paid for the reported OnePlus account-token exposure vulnerability.
OnePlus validated Doyensec's finding and assigned it a high-severity rating, after it had initially been reported as critical.
Doyensec disclosed the vulnerability to OnePlus, reporting that an untrusted installed application could access the exported OPAccountProvider and retrieve an authenticated OnePlus Cloud session token.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourceblog.doyensec.com
Open sourcefrida.re
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A researcher disclosed a two-stage local privilege-escalation chain affecting OnePlus and OPPO devices running OxygenOS, including the OnePlus 15 on OxygenOS `16.0.3.503` and the OnePlus 12 Pro. A normally installable sideloaded app with no declared permissions can invoke the root-running `AtlasService` and inject shell commands through the `audiodumpinfo` debug service, obtaining execution as root in the SELinux `dumpstate` domain. The chain then abuses the Oplus Log Core (`olc2`) vendor HAL's UID-0-restricted `doShell` method to run commands in the `vendor_qti_init_shell` SELinux domain, whose bounding set includes all Linux capabilities. OnePlus reportedly confirmed in May that multiple products and software versions are affected, but no complete affected-device list, CVE identifier, remediation details, or evidence of exploitation in the wild had been published.
Sep 24, 2026
A critical vulnerability (CVE-2025-10184) in OnePlus OxygenOS allows any app to silently access SMS and MMS data without user interaction or special permissions. The flaw, present since OxygenOS 12, could enable attackers to bypass SMS-based MFA and access sensitive communications. Despite repeated attempts by Rapid7 to coordinate a fix, OnePlus has not responded, prompting public disclosure and recommendations for users to switch to authenticator apps and encrypted messaging.
Jun 29, 2026
Researchers at Enclave disclosed a vulnerability dubbed **FlagLeft** in six Microsoft 365 Android apps that allowed any co-installed third-party app to silently obtain valid Microsoft account tokens from a signed-in user. The flaw stemmed from a production debug setting, `setIsDebugMode(true)`, left enabled in a shared Microsoft SDK, which disabled the authorization check meant to ensure tokens were handed only to trusted Microsoft apps. Affected apps included **Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote**; **Teams** was reportedly not affected because its production debug flag was configured correctly. Because the apps relied on **FOCI** token sharing for single sign-on, a malicious Android app could potentially capture long-lived refresh tokens and access Microsoft services including **email, OneDrive files, calendars, and messaging functions** without a password, login prompt, or permission prompt. Microsoft confirmed the issue, assigned multiple CVEs—including four covering Copilot, Word, PowerPoint, and Excel with CVSS scores ranging from **4.4 to 7.7**—and shipped fixes through Google Play updates. Researchers said there was no public evidence of active exploitation before remediation, but warned that previously exposed refresh tokens may remain valid after app updates, making token revocation and verification of patched app versions important for affected organizations.
Jun 29, 2026