Critical SMS/MMS Data Exposure Vulnerability in OnePlus OxygenOS Remains Unpatched
4 sources · Updated 5mo ago · First seen Sep 23, 2025
A critical vulnerability (CVE-2025-10184) in OnePlus OxygenOS allows any app to silently access SMS and MMS data without user interaction or special permissions. The flaw, present since OxygenOS 12, could enable attackers to bypass SMS-based MFA and access sensitive communications. Despite repeated attempts by Rapid7 to coordinate a fix, OnePlus has not responded, prompting public disclosure and recommendations for users to switch to authenticator apps and encrypted messaging.
Do you run this?See affected versions and whether adversaries are exploiting it against assets like yours.
Check your exposure
