OnePlus Text Exposure Flaw Promptly Addressed in Upcoming Fix: Apps No Longer Able to Read Messages

Critical Security Flaw Discovered in OnePlus Phones: user Texts at Risk

Published: September 26, 2025 at 10:00 AM PST

OnePlus device owners are being warned of a notable security vulnerability that could allow malicious applications to intercept and send text messages without explicit user permission. The flaw, identified as CVE-2025-10184, impacts a range of devices and could compromise sensitive personal data.

Security researchers at Rapid7 uncovered the issue, wich stems from alterations made by OnePlus to android’s standard telephony content provider. The modifications introduced new components without adequate security restrictions, creating an opening for exploitation through techniques like SQL injection.

What’s at Stake?

This vulnerability isn’t merely an inconvenience; it poses a real threat to user security. Attackers could potentially intercept two-factor authentication (2FA) codes sent via SMS, gaining unauthorized access to accounts. They may also be able to send messages on a user’s behalf, leading to potential fraud or reputational damage.

The issue affects devices running OxygenOS versions 12 through 15. Older devices that utilize oxygenos 11 are not believed to be impacted. the vulnerability’s scope extends to recent OnePlus models, elevating the risk for a considerable number of users.

OxygenOS Version	Vulnerability status
11 and below	Not Affected
12-15	Vulnerable

Delayed Response Raises Concerns

The discovery of this flaw initially occurred in May 2025, with Rapid7 repeatedly attempting to notify OnePlus. Though, a response was not received for several months. It wasn’t until the researchers publicly disclosed thier findings and released a proof-of-concept demonstration that OnePlus acknowledged the issue and began working on a resolution.

did You Know? According to Statista, over 85% of all two-factor authentication methods rely on SMS, making this vulnerability a widespread concern.

Patch on the Horizon

OnePlus has now confirmed the advancement of a security patch designed to address the vulnerability. The company anticipates a global rollout of the update starting in mid-October.The patch aims to correct the permission bypass and effectively close the SMS loophole.

Until the update is installed, users are strongly advised to exercise caution when installing applications. Downloading apps only from trusted sources, such as official app stores, is crucial. Removing unused or suspicious applications is also recommended.As an added precaution, users should consider utilizing more secure 2FA methods, like authenticator apps or hardware security keys which are less susceptible to SMS-based attacks.

Pro Tip: Regularly review the permissions granted to applications on your device. Revoke access for any apps that don’t demonstrably need it.

Understanding SMS Security and best Practices

The incident underscores the evolving landscape of mobile security threats. While SMS-based 2FA has been a mainstay for years, it’s increasingly recognized as less secure than alternative methods. The interception of SMS messages is not a new threat – SIM swapping attacks, for example, have been a concern for some time. Leveraging authenticator apps or hardware keys considerably reduces this risk, as they are less susceptible to remote interception.

Furthermore, maintaining a proactive approach to software updates is critical. Manufacturers regularly release patches to address newly discovered vulnerabilities. Promptly installing these updates is a basic step in protecting your device and personal facts.

Frequently Asked Questions

• What is the OnePlus SMS vulnerability? This is a flaw in OnePlus phones running OxygenOS 12-15 that allows apps to read and send your texts without permission.
• Which OnePlus phones are affected by this flaw? Devices running OxygenOS 12 through 15 are potentially vulnerable.
• How can I protect myself from this vulnerability? Only install apps from trusted sources and consider using alternative 2FA methods.
• When will the fix be available? OnePlus is rolling out a patch starting in mid-October.
• Is OxygenOS 11 affected by this vulnerability? No, devices running OxygenOS 11 or earlier are not believed to be impacted.
• What is 2FA and why is it vital? Two-Factor Authentication adds an extra layer of security to your accounts.
• What are authenticator apps and hardware security keys? These are more secure ways to generate 2FA codes.

What do you think about this security vulnerability? Share your thoughts in the comments below!

What specific technical flaw in OxygenOS allowed apps to bypass Android’s intended SMS permission restrictions?

Understanding the OnePlus Message Access Vulnerability

Recent reports highlighted a significant privacy concern for OnePlus smartphone users: a flaw allowing third-party apps unauthorized access to text messages. This oneplus security vulnerability stemmed from an issue within the OxygenOS operating system, specifically relating to permissions granted to applications. The problem wasn’t a hack of OnePlus, but rather a misconfiguration allowing apps to request and, crucially, receive SMS data beyond what was necessary for their intended function. This meant apps – even seemingly benign ones – could perhaps read yoru text messages, including sensitive facts like verification codes, personal conversations, and financial details. The issue affected various OnePlus phone models running specific OxygenOS versions.

How the Flaw Was Discovered & Reported

The vulnerability was initially brought to light by researchers at the security firm Checkm8, who detailed their findings publicly. Their investigation revealed that the issue wasn’t limited to a single app, but a systemic problem within the permission handling of OxygenOS. The revelation sparked immediate concern within the Android security community and among OnePlus users, prompting a swift response from the company. Independent security analysts quickly verified the findings, confirming the potential for widespread SMS data breach.

The Root cause: OxygenOS Permission Model

The core of the problem lay in how oxygenos handled the READ_SMS permission.While Android’s permission system is designed to protect user data,the implementation within OxygenOS allowed apps to bypass intended restrictions. Specifically:

* Overly Broad Permissions: Apps were able to request and receive SMS permissions without a clear justification or limitation on the data accessed.

* Lack of Granular Control: Users lacked the ability to selectively grant access to specific types of SMS data, leading to all-or-nothing permission settings.

* Insufficient Validation: OxygenOS didn’t adequately validate why an app needed SMS access, potentially allowing malicious or poorly coded apps to exploit the vulnerability.

This created a scenario where apps could access SMS data even if it wasn’t essential for their core functionality, raising serious privacy concerns.

OnePlus’s Response: A Swift Patch is on the Way

OnePlus reacted quickly to the reports, acknowledging the vulnerability and committing to a fix. The company has confirmed that an OxygenOS update is being rolled out to address the issue.This update focuses on:

* Restricting SMS access: The update will tighten the restrictions on the READ_SMS permission, requiring apps to provide a more compelling reason for accessing text messages.

* Enhanced Permission Validation: OxygenOS will implement stricter validation checks to ensure apps only request the necessary permissions.

* Improved User Control: future OxygenOS versions are expected to offer more granular control over app permissions, allowing users to selectively grant access to specific data types.

* Security Patch Level: The update includes the latest Android security patch, further bolstering the device’s overall security posture.

Wich OnePlus Devices Are Affected?

While oneplus hasn’t released a comprehensive list, the vulnerability is known to affect the following devices running affected OxygenOS versions:

* OnePlus 8 series

* OnePlus 9 series

* OnePlus 10 series

* OnePlus 11 series

* OnePlus 12 series

* Nord series (various models)

Users are advised to check for updates in their device settings (Settings > System > System updates) and install them as soon as they become available. The rollout is staged, so it may take a few days for the update to reach all devices.

How to Protect Yourself Before the Update

while waiting for the OxygenOS update, users can take several steps to mitigate the risk:

1. Review App Permissions: Go to Settings > Apps > Permissions and carefully review which apps have SMS access.
2. Revoke Unnecessary Permissions: Revoke SMS access from any apps that don’t absolutely require it. Be cautious, as some legitimate apps (like banking apps for two-factor authentication) may need this permission.
3. Use a Secure Messaging App: Consider using end-to-end encrypted messaging apps like Signal or WhatsApp for sensitive conversations.
4. Be Wary of New Apps: Exercise caution when installing new apps, especially those from unknown sources.
5. Monitor Account Activity: Regularly monitor your bank accounts and other sensitive accounts for any suspicious activity.

Long-Term Implications for OnePlus & Android Security

This incident highlights the importance of robust permission management and ongoing security audits within the Android ecosystem. For OnePlus, it underscores the need for:

* proactive Security Testing: Investing in more comprehensive security testing throughout the advancement process.

* Transparency with Users: Providing clear and concise information about app permissions and data usage.

* Faster Security Updates: Expediting the rollout of security updates to address vulnerabilities promptly.

The OnePlus text message leak serves as a reminder for all