ColorOS-CVE-2025-10184

Information Source
Vulnerability Principle & Solution Technical Analysis

Vulnerability Details

• Type: Database injection attack 1=1 AND
• Impact: Any app can read SMS data. No permissions required, no user interaction, undetectable reading
• Affected: All SMS messages and verification codes on the device are leaked.
• Scope: OPPO and its sub-brands (OnePlus, realme)
• Affected Versions: According to device models submitted by maoyixuan, ColorOS 6.0.1 released in 2017 is vulnerable, suggesting this flaw may have accompanied OPPO's OEM journey
• Patch Status: System file updates (15.0.0.860Patch01|1.9MB) began rolling out to ColorOS 15 on October 4, followed by ColorOS 12-14 on October 9.
• Test Tool: Download yuu_v3.6.apk (Domestic). If SMS content appears, the vulnerability exists. The test app has no network connectivity. OPPO flags it as a risky app via package name matching; simply disconnect from the internet before installing. You can review the source code if unsure, and uninstall promptly after testing.
• Protection Strategies for General Users:
  1. Until the vendor patches the vulnerability, remove your SIM card and use it in a phone from another brand.
  2. Delete all SMS messages on the device as soon as possible and ensure permanent deletion. Avoid using SMS data for user profiling.
  3. Use an Android virtual machine or cloud phone to run applications.
  4. When using SMS verification, try to ensure no background applications are running.
• Self-Help Solutions: Non-root mitigation and stable root-based interception methods.

Patch Update (October 4)

@C and other helpful community members, ensure you disable the Cross Profile Test App before updating, otherwise installation may get stuck at 0.0%.

Confirmed rollout has begun; pushed starting morning of October 4.

• System Version: ColorOS 15.0.0, 15.0.1, 15.0.2
• Actual Package: com.android.providers.telephony 15.40.10 (35)
• Update Path: Settings → System & Updates → Software Update → Auto Update Settings → System File Update
• System File: 15.0.0.860Patch01|1.9MB. Files vary by device model; refer to actual push notifications.
• Patch Effectiveness:

Forced Update

The 15.0.0.860Patch01|1.9MB push package's Phone_SMS Storage_15.40.10.apk only supports ColorOS 15.0.0, 15.0.1, and 15.0.2. Detailed push package contents Source: Telegram @SnowWolf725

Download Phone_SMS Storage.apk. Note: Must match your system version.
Use adb command: adb install -t D:\xxx.apk
Reboot the device after successful installation to apply changes. If errors occur, uninstall the installed version.

Vulnerability Demonstration

You can upload screenshots with sensitive data redacted to the Issues page

Self-Help Solutions for General Users

Method 1: Use SMS Spam Blocking (Universal Method)

From v2ex@CoolMarket
Enable SMS spam blocking, block all numbers. This will route incoming SMS to the spam folder, preventing software from reading them.

Path: Messages → Spam Block → Block Rules → Message Block → Custom Block Keywords → Top-right ➕ icon → Copy and paste the following line by line:

0,1,2,3,4,5,6,7,8,9
#,*,+,@,.,【,(,（,，
-,/,!,码,中,余,元,退,
a,b,c,d,e,f,g,h,i,j,
k,l,m,n,o,p,q,r,s,t,
u,v,w,x,y,z,A,B,C,D,
E,F,G,H,I,J,K,L,M,N,
O,P,Q,R,S,T,U,V,W,X,
Y,Z,零,一,二,三,四,五,六,
七,八,九,十,百,千,万

Verification: Send a new SMS (e.g., message to 10086). After receiving it, check the spam folder for a blocked message. Then open the test tool to see if the message appears. If it does not appear, the method is effective.

This is the simplest method; recommended for older devices.

Method 2: Modify via Shizuku

Improved based on the method proposed by v2ex@Dawnnnnnn. ⚠️ Modifying system content carries risks! Not available for all devices.

1. Download Shizuku and Blocker. (If installation fails, disconnect from the network and try again.)
2. Follow the tutorial to enable wireless debugging and start Shizuku
3. In Blocker settings, change Controller Type to Shizuku/Sui, and grant Shizuku permission to Blocker.
4. In Blocker settings, enable Show System Apps.
5. In Blocker, search for telephony, and enter the Phone/SMS Storage app.
6. Select Content Providers, and disable the three options: PushMessageProvider, PushShopProvider, and ServiceNumberProvider.
7. ⚠️ Note: Configuration is complete here. The effect lasts until the next reboot. After rebooting, you will be unable to receive SMS (sending works). You must re-enable the three options from the previous step, then reboot again to receive SMS normally. Once confirmed working, disable the three options again. This provides interception while maintaining normal SMS functionality until the next reboot.

Why It Might Not Work

Modification takes effect only when the AndroidManifest.xml inside com.android.providers.telephony contains the android:testOnly="true" attribute. See specific reasons here

Root-Based Interception Methods