**Name of the Vulnerable Software and Affected Versions**

OnePlus devices running OxygenOS versions 12 through 15

**Description**

The issue allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is not notified that SMS data is being accessed. This could lead to sensitive information disclosure and could break the security provided by SMS-based Multi-Factor Authentication (MFA) checks. The root cause is a combination of missing permissions for write operations in several content providers (com.android.providers.telephony.PushMessageProvider, com.android.providers.telephony.PushShopProvider, com.android.providers.telephony.ServiceNumberProvider), and a blind SQL injection in the `update` method of those providers.

**Recommendations**

At the moment, there is no information about a newer version that contains a fix for this vulnerability.