Loading story…
A critical vulnerability (CVE-2025-10184) in OnePlus OxygenOS allows any app to silently access SMS and MMS data without user interaction or special permissions. The flaw, present since OxygenOS 12, could enable attackers to bypass SMS-based MFA and access sensitive communications. Despite repeated attempts by Rapid7 to coordinate a fix, OnePlus has not responded, prompting public disclosure and recommendations for users to switch to authenticator apps and encrypted messaging.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The Register and BleepingComputer reported that OnePlus phones remained vulnerable to the unpatched flaw and that researchers had not received a fix from the vendor. The coverage emphasized the risk that rogue apps could read text messages on affected devices.
On its blog, Rapid7 disclosed CVE-2025-10184 and stated that the OnePlus OxygenOS telephony provider permission-bypass issue had not been fixed. The disclosure said the bug could expose users' text messages to rogue apps.
Rapid7 identified a vulnerability in OnePlus OxygenOS's telephony provider that could let a malicious app access text messages through a permission bypass. The flaw was later assigned CVE-2025-10184.
4 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity flaw in the preinstalled `com.oneplus.account` app on OnePlus 13R devices allows any installed malicious app to obtain an authenticated OnePlus Cloud session token. The exported `OPAccountProvider` content provider relies on `com.oneplus.account.READ_ACCOUNT_INFO`, a permission that third-party apps can declare because it is not restricted to software signed by OnePlus; an app can then invoke `get_account_oneplus_token` to retrieve `oldSecondaryToken` without user interaction beyond installation. The exposed token was accepted by the OnePlus Cloud API and was demonstrated to enable modification of victim account data, creating a path to account session takeover. Doyensec confirmed the token exposure remained in firmware `CPH2691_16.0.10.500(EX01)` and disclosed the issue publicly after OnePlus had not remediated it.
Sep 10, 2026
A critical authentication bypass vulnerability, tracked as **CVE-2026-15014**, affects the **SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery** WordPress plugin in versions through `3.9.7`. The flaw stems from the plugin trusting a session-level `$_SESSION['sa_mobile_verified']` flag that is not bound to the specific phone number that completed OTP verification. An unauthenticated attacker can verify a phone number they control, then resubmit registration data with a victim’s `billing_phone` value and trigger `wp_set_auth_cookie()` for the victim account. The bug carries a **CVSS 9.8** severity rating and can allow takeover of any existing WordPress user whose registered phone number is known or guessable, including administrators, potentially leading to full site compromise. Reports say public proof-of-concept details are available and exploitation attempts have already been observed. The issue is fixed in version `3.9.8`, and defenders are being urged to update immediately or temporarily disable the plugin while ensuring OTP verification is tied to the verified phone number.
Jul 28, 2026
Google said it is rolling out a fix for an Android 16 lock-screen bypass in **Gemini** that allows someone with brief physical access to a locked phone to send **SMS** and **WhatsApp** messages without entering a PIN, password, or biometric. Researchers and follow-on reporting said the flaw can be triggered through a specific multi-touch interaction when Gemini is invoked from the lock screen and prompted to open apps such as Messages, bypassing the expected authentication step. Google said the issue is not limited to Pixel devices, though it did not identify all affected manufacturers or models. The bug was reproduced on a fully patched **Pixel 6a** and appears tied to Gemini's **Deep Research** and lock-screen app-handoff behavior, where authentication checks can fail during transitions from the lock-screen overlay into the full app. Reporting said the weakness may also let an attacker regain Gemini access to previously disconnected apps, switch accounts, view or delete Gemini conversation history, change some security settings, and exfiltrate data while leaving no failed unlock attempts logged. The researcher who disclosed the issue said it reflects an incomplete fix for an earlier reported vulnerability and points to a broader trust-boundary problem in how lock-screen restrictions are enforced across Gemini activities.
Jul 21, 2026