OnePlus phones leak text messages to any installed app, researchers warn

Key points

• Any app installed on affected OnePlus phones can read text messages and their metadata without asking permission or alerting the owner, according to a Rapid7 advisory published this month.
• The bug is tracked as CVE-2025-10184 and sits in OxygenOS, the version of Android that OnePlus ships on its handsets.
• Rapid7 says it couldn't get OnePlus to respond through normal channels, and disclosed the flaw as unfixed on the day the advisory went live.
• The most direct consequence is that one-time security codes sent by SMS can be silently harvested by banks, payment apps or any other service using them.
• Rasmus Moorats, a separate researcher, showed that two other OnePlus bugs can be chained on a brand-new OnePlus 15 to give an app full root control with no permissions at all.

Rapid7 has published an advisory describing a permission bypass in OxygenOS, the software OnePlus layers on top of Android. The failure mode is simple and ugly. A normal app, one that asks for none of the usual permissions, can quietly read the user's text messages and metadata about who sent them.

On Android, text messages live in a system component called the Telephony provider. Apps are supposed to hold the READ_SMS permission before they touch it, and the phone is supposed to prompt the owner before granting that. On affected OnePlus builds, that check is missing on part of the interface. Any installed app can walk straight in.

Why does this matter for ordinary users?

Banks, email providers and workplace logins still text you a six-digit code to prove it's you. That's SMS-based multi-factor authentication, the extra code you type after your password. If an app on your phone can read those codes without your knowledge, the second factor stops working as one.

Rapid7 flags this risk directly. A wallpaper pack or a free game, on a vulnerable device, could copy every code your bank sends you. No prompt appears. No notification fires.

Which phones are affected?

Rapid7 tested several OnePlus models running OxygenOS and expects the problem extends beyond those it confirmed. The company says the bug has been present since around the OxygenOS 12 release in 2021. OnePlus is owned by OPPO and shares code with it. Moorats was told by OnePlus that OPPO devices are affected too, though no full device list has been published.

What went wrong between the researchers and OnePlus?

Rapid7 says it tried repeatedly to reach OnePlus and got no useful reply. OnePlus runs a bug bounty program, where companies pay outside researchers who report flaws, but Rapid7 says its terms include a non-disclosure clause the firm won't sign. The flaw went public unfixed on 24 September. OnePlus acknowledged the report the same day and told Rapid7 a fix is targeted for a mid-October rollout.

That communication failure is worth naming. We covered Rapid7's argument that fixed-schedule patching is breaking down under the volume of new vulnerabilities back in August; the NDA standoff here is a harder problem, because a vendor's legal terms are holding a user-safety fix hostage.

Separately, Moorats chained two OnePlus bugs on a new OnePlus 15 to achieve root, the highest level of control on an Android phone, again from an app carrying no permissions. Different bugs, same pattern: OxygenOS trusting things it should be verifying.

Should you worry?

Yes, if your organisation has OnePlus or OPPO handsets touching high-value accounts. This quietly rots any SMS-code login those users rely on, and the October patch hasn't landed yet. Move those accounts to an authenticator app or a hardware key now. Hold sideloading to a hard no until the patch arrives and you can verify it deployed.