OnePlus 13R Preinstalled Account App Leaks Cloud Session Tokens to Any App Declaring Required Permission
Researchers from Doyensec have discovered a vulnerability in the preinstalled software on the OnePlus 13R that allows a third-party application to steal a valid OnePlus Cloud session token. The issue resides in the com.oneplus.account application responsible for managing authentication to the manufacturer’s services.
The exposed component OPAccountProvider is protected by the permission com.oneplus.account.READ_ACCOUNT_INFO. However, developers failed to set protectionLevel="signature", which would have restricted access exclusively to applications signed by OnePlus. As a result, any third-party application can simply declare the same permission in its manifest and query the provider.
Upon receiving a specific command, the provider returns the active OnePlus Cloud session token. No pop-up dialogs, security warnings, or explicit user consent are required. In the initial proof-of-concept, researchers used the stolen token to call OnePlus Cloud APIs and modify the victim’s personal data.
Doyensec reported the vulnerability to OnePlus on 30 December 2025. The vendor acknowledged the issue, rated its severity as high, and paid the researchers $720 in March 2026. A patch, however, has been slow to arrive.
In September, re-testing on firmware CPH2691_16.0.10.500(EX01) confirmed that an untrusted application can still obtain the token and that the regional API continues to accept it. Full reproduction of account data changes for US and EMEA accounts was no longer possible due to service-side modifications, meaning token leakage remains while complete account takeover on the latest version has not been verified.
Users are recommended to avoid installing applications from untrusted sources and to monitor for updates. OnePlus simply needs to add the single word “signature” to the permission definition to resolve the exposure.
Related articles
Oracle Releases October 2026 Critical Patch Update Fixing 1,295 Vulnerabilities Across Multiple Products
Oracle has published its quarterly Critical Patch Update (CPU) on October 20, 2026, delivering a total of 1,295 security patches for a wide range of products. After removing duplicates, the update addresses 1,209 unique CVEs. The highest number of fixes went to Oracle Fusion Middleware with 206 patches, followed by Oracle E-Business Suite with 194, Oracle Communications with 110, Oracle MySQL with 98, and Oracle Java SE with 55. Among the vulnerabilities, 587 received a CVSSv3 base score of 7.0 or higher, including 112 rated 9.0 or above. Six vulnerabilities scored the maximum 10.0, one of which is CVE-2026-101809 in Oracle E-Business Suite Workflow Notification Mailer that can be exploited remotely without authentication over HTTP.
Why Traditional Vulnerability Scanners Fail in Kubernetes and Cloud Environments
Traditional vulnerability management approaches break down when applied to containers and cloud infrastructure because containers are ephemeral, internal networks are invisible from the outside, and misconfigurations can be introduced at build time. The article highlights the 2018 Tesla Kubernetes incident where an exposed dashboard allowed cryptomining via stolen AWS credentials without any code vulnerabilities. Container security tools are required to scan images during build, enforce policies at deployment, and monitor runtime behavior, unlike classic scanners that only examine running workloads. Key configuration risks include privileged pods, missing NetworkPolicy objects, and overly broad RBAC roles such as cluster-admin. Supply chain protections like Sigstore image signing and SBOM generation are presented as essential for preventing compromised base images and hidden dependencies. Cloud environments add shared responsibility models, dynamic scaling challenges, and regulatory constraints that further limit the effectiveness of legacy VM tools. Specialized platforms such as CNAPP solutions are recommended alongside Russian domestic tools like PT Container Security and Kaspersky Container Security.
Google Releases Chrome 156 Fixing 353 Vulnerabilities Including Six Critical Issues
Google has released Chrome 156 for Windows, macOS, and Linux, addressing a total of 353 vulnerabilities tracked via CVE identifiers. Six of these flaws received the highest Critical severity rating, primarily involving memory corruption in components such as Skia, Accessibility, CSS, Paint, and WebRTC. One additional Critical issue is a Use-After-Free vulnerability in Accessibility reported by Anthropic researcher Xinyang Ge with assistance from Claude. Sixty-one High severity vulnerabilities were also fixed across V8, ANGLE, WebRTC and other modules, covering memory corruption, use-after-free conditions, and input validation problems. The update further resolves 197 Medium and 89 Low severity issues. Patches are being deployed gradually over the coming days and weeks to all supported platforms.
Multiple Critical Vulnerabilities Found in PHP, Fixes Scheduled for October 21
The PHP security team has confirmed two serious vulnerabilities in the PHP scripting language. Both issues received a CVSSv4.0 base score of 9.2, placing them in the Critical severity category. The team announced the upcoming security update on October 20, 2026, and plans to release the patched versions at 14:00 UTC on October 21, which corresponds to 23:00 Japan time. Specific technical details, affected components, and vulnerable versions remain undisclosed until the patches are published. The team urges administrators to prepare for immediate updates once the fixes become available. Earlier release is possible if vulnerability details leak or active exploitation is detected.