APK Build for CVE‑2025‑10184 PoC

This is an APK Build for a PoC of CVE‑2025‑10184

The vulnerability exists in com.*.providers.telephony, allowing arbitrary applications to read SMS messages without SMS read permission

Source Code

The source code and more details can be found in Rapid7's article:
https://www.rapid7.com/blog/post/cve-2025-10184-oneplus-oxygenos-telephony-provider-permission-bypass-not-fixed/

Download

After logging in, download the unsigned package from Actions

Verification

It has been confirmed that OPPO and its sub-brands, all versions since ColorOS 7.1, are affected

Fix

OPPO has officially fixed this issue (by replacing the permission declared by the Provider with OPLUS_COMPONENT_SAFE) and is currently rolling out the update gradually

Can't wait for OPPO anymore, I'll fix it myself

The simplest fix: just verify whether the caller has SMS permission before performing operations
Note: This method has been verified to prevent reading, and does not affect the reading of applications that actually have SMS permission, but no other usability impact tests have been conducted

Add runtime permission check at the beginning of the update method in the ServiceNumberProvider class:

 .method public update(Landroid/net/Uri;Landroid/content/ContentValues;Ljava/lang/String;[Ljava/lang/String;)I
     .registers 8

+    invoke-virtual {p0}, Lcom/android/providers/telephony/ServiceNumberProvider;->getContext()Landroid/content/Context;
+    move-result-object v0
+    
+    const-string v1, "android.permission.READ_SMS"
+    const-string v2, "Requires READ_SMS permission"
+    invoke-virtual {v0, v1, v2}, Landroid/content/Context;->enforceCallingPermission(Ljava/lang/String;Ljava/lang/String;)V
+   
     .line 157
     iget-object p0, p0, Lcom/android/providers/telephony/ServiceNumberProvider;->mOpenHelper:Lcom/android/providers/telephony/MmsSmsDatabaseHelper;
 
     invoke-virtual {p0}, Lcom/android/providers/telephony/MmsSmsDatabaseHelper;->getWritableDatabase()Landroid/database/sqlite/SQLiteDatabase;
 
     move-result-object p0
 
     # ... 省略其余原有代码
 .end method

The update methods in the PushMessageProvider and PushShopProvider classes also need to add the above code

After modification, please do not sign and install it with core crack (核心破解); otherwise, it will break the entire calling functionality and all SMS messages will be lost (due to system security mechanisms)