CVE-2025-10184 OnePlus OxygenOS Telephony provider permission bypass
Any app can read SMS data without permission due to missing authorization checks, compromising SMS-based MFA and exposing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-10184?
CVE-2025-10184 is a high-severity missing authorization vulnerability in OnePlus OxygenOS, published on 23 Sep 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is also not notified that SMS data is being accessed. This could lead to sensitive information disclosure and could effectively break the security provided by SMS-based Multi-Factor Authentication (MFA) checks.
The root cause is a combination of missing permissions for write operations in several content providers (com.android.providers.telephony.PushMessageProvider, com.android.providers.telephony.PushShopProvider, com.android.providers.telephony.ServiceNumberProvider), and a blind SQL injection in the update method of those providers.
Which versions are affected by CVE-2025-10184?
How do I fix CVE-2025-10184?
No fix has been published for CVE-2025-10184 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-10184 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-10184 exists.
Public exploit code: 3 proofs of concept on GitHub.
Sources
Also known as GHSA-q9jj-p5hc-gfmj.