CVE-2025-10184highCWE-862CWE-89

CVE-2025-10184: fallo de gravedad alta en OnePlus OxygenOS

OnePlus OxygenOS Telephony provider permission bypass

Publicada el

Seguir esta CVE+ Monitorear OxygenOS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.2epss 5.1%
The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is also not notified that SMS data is being accessed. This could lead to sensitive information disclosure and could effectively break the security provided by SMS-based Multi-Factor Authentication (MFA) checks. The root cause is a combination of missing permissions for write operations in several content providers (com.android.providers.telephony.PushMessageProvider, com.android.providers.telephony.PushShopProvider, com.android.providers.telephony.ServiceNumberProvider), and a blind SQL injection in the update method of those providers.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Productos afectados
OnePlus · OxygenOS
CVEs relacionadas — OnePlus OxygenOS

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-70386HIGHOnePlus OxygenOS improper neutralization of special elements vulnerabilityEPSS 1.4%CVE-2026-70387HIGHOnePlus OxygenOS exposed dangerous method vulnerabilityEPSS 0.3%