A critical vulnerability (CVE-2025-10184) in OxygenOS (versions 12 to 15) on OnePlus devices exposes SMS data and metadata to any installed app without requiring permissions or user interaction. The flaw stems from OnePlus modifying Android’s default Telephony package, introducing unsecured content providers (`PushMessageProvider`, `PushShopProvider`, `ServiceNumberProvider`) that lack proper `READ_SMS` permission checks. Worse, unsanitized inputs enable blind SQL injection, allowing attackers to reconstruct SMS content character-by-character by exploiting database queries. While the `read` permission is correctly enforced, the absence of `write` permission restrictions lets malicious apps infer SMS data if prerequisites are met (e.g., non-empty tables or insert capabilities).The vulnerability, discovered by Rapid7 and left unpatched due to OnePlus’s non-response, affects multiple models (e.g., OnePlus 8T, 10 Pro) across all OxygenOS versions since 2022. Attackers could exploit this to bypass 2FA, intercept sensitive messages (e.g., OTPs, financial alerts), or exfiltrate private communications. OnePlus acknowledged the issue only after public disclosure, leaving users exposed until a fix is released. Mitigations include minimizing app installations, avoiding SMS-based 2FA, and using end-to-end encrypted messaging for sensitive data.

OnePlus acknowledged that a security breach had compromised its online payment system. Numerous consumers of the Chinese smartphone maker reported experiencing fraudulent credit card transactions after making purchases via the company's online store. After multiple reports of fraudulent credit card transactions from consumers who made purchases on the company's official website, OnePlus has finally acknowledged that there was a breach in its online payment system. Attackers leveraged the script to capture credit card details as customers input them to make purchases on the website. From a customer's browser window, the script was utilised to extract all credit card information, including card numbers, expiration dates, and security codes.