Your OnePlus phone is probably at risk from a major SMS vulnerability

The majority of ONEPLUS phones used today can be vulnerable to a security defect that leaves the SMS and MMS data exposed, and it will not be corrected until mid-October. Only ONEPLUS phones still work on oxygenos 11 or more before the flaw.

The Safety Company Rapid7 was the first to discover vulnerability, which relates to changes to OnePlus to the telephone service in Android. The long and the short is that it would allow installed applications to access SMS data “without authorization, user interaction or consent”. The company has found the flaw on the devices performing oxygenos 12, 14 and 15, although it reported that the old oxygenos 11, based on Android 11, is not vulnerable. While Rapid7 has only tested two types of equipment – the OnePlus 8T and 10 Pro 5G – he says that the fault “affects a central component of Android”, and it is therefore unlikely to be specific to the material.

OnePlus admitted the question, but in a declaration given to 9TO5GOOGLE By a nameless spokesperson, he indicates that a fix will not arrive before mid-October at the earliest.

We recognize the recent disclosure of CVE-2025-10184 and have implemented a correction. This will be deployed worldwide via the software update from mid-October. OnePlus remains determined to protect customer data and will continue to prioritize security improvements.

Rapid7 announced the discovery on his blog on Monday this week, but OnePlus did not respond until Wednesday. Rapid7 says he tried and failed to contact OnePlus in private to discuss the problem, and turned to public disclosure after also excluding the company’s bug bonus program due to its “restrictive non-disclosure agreement”.

Until the defect is corrected, RAPID7 recommends that ONEPLUS peripheral owners will only be applications from sources of trust, uninstall unnecessary applications, switch to encrypted messaging applications and use authenticator applications rather than two -factor authentication based on SMS.