OnePlus 13R Preinstalled App Lets Malicious Apps Hijack Cloud Sessions

The OnePlus 13R’s preinstalled com.oneplus.account app contains an exported content provider that any installed app can query to retrieve a valid OnePlus Cloud session token, allowing attackers to impersonate the user, steal personal data, and modify cloud‑based settings without user consent.

Who is affected by this vulnerability?

All devices shipping with the OnePlus 13R model are impacted because the vulnerable com.oneplus.account component is bundled in the stock firmware. Any third‑party app that a user installs can request the com.oneplus.account.READ_ACCOUNT_INFO permission, which is not limited to apps signed by OnePlus, and then call the exported provider to pull the token.

How does the exported content provider enable session takeover?

The content provider is marked as exported=true, meaning it accepts calls from any app on the device. It does not enforce a signature check or a privileged permission check beyond the loosely‑scoped READ_ACCOUNT_INFO. When a malicious app invokes the provider, it receives a JSON payload that includes the authenticated OnePlus Cloud session identifier, which the attacker can replay to the OnePlus backend as the legitimate user.

Because the token is a bearer token, possession alone grants full access to the user’s OnePlus account, including contact sync, device settings, and cloud‑stored backups. The attacker can then issue API calls to read or modify data, effectively hijacking the session.

What attack scenarios are realistic in the wild?

Threat actors could embed the exploit in a seemingly benign ad‑library or a popular utility app that requests minimal permissions. Once installed, the malicious code silently extracts the token and forwards it to a command‑and‑control server. From there, the attacker can perform actions such as:

• Reading contacts and messages synced to OnePlus Cloud.
• Changing device lock settings or pushing unwanted configuration profiles.
• Uploading malicious files to the cloud backup, potentially affecting other linked devices.

Because the exploit does not require root or a vulnerability in the Android kernel, it works on any unpatched OnePlus 13R device, regardless of the Android version.

Why did this flaw slip through OnePlus’s security review?

OEM‑specific components often receive less scrutiny than core Android framework code. The com.oneplus.account app runs with elevated privileges to manage the user’s OnePlus account, yet the permission model used (READ_ACCOUNT_INFO) is declared as a normal permission, which any app can request without user awareness. Researchers from Doyensec highlighted that the permission was not protected by a signature or a privileged level, a design oversight that opened the attack surface.

Additionally, the exported flag on the content provider was likely intended for inter‑process communication within trusted OnePlus services, but without proper access control it became a public gateway.

How can users protect themselves today?

Until OnePlus releases a firmware patch that restricts the provider or changes the permission to a signature‑level flag, users should adopt a defense‑in‑depth approach:

• Audit installed apps and remove any that are unnecessary or come from unknown developers.
• Use a reputable mobile security suite that can flag apps requesting the com.oneplus.account.READ_ACCOUNT_INFO permission.
• Enable two‑factor authentication on the OnePlus Cloud account if the service supports it, limiting the damage of a stolen token.
• Monitor account activity for unexpected changes, such as new devices or altered settings.

Enterprise device‑management solutions can also enforce a whitelist of approved apps, preventing rogue software from gaining the needed permission.

What is OnePlus doing to remediate the issue?

According to the disclosure discussed by researchers, OnePlus has acknowledged the flaw and is preparing an over‑the‑air (OTA) update that will either make the content provider non‑exported or tighten the permission to a signature‑only level. The timeline for the patch has not been publicly announced, but the company’s security bulletin indicates a high‑severity rating and a commitment to release a fix within the next few weeks.

What this means for you

The session‑takeover vulnerability demonstrates that preinstalled OEM apps can become a hidden attack vector, even on devices that appear fully patched. Users of OnePlus 13R should treat any newly installed app with suspicion, especially if it requests unusual permissions related to account information. Until the OTA fix arrives, limiting app installations, employing mobile‑security tools, and monitoring OnePlus Cloud activity are the most effective safeguards.

Frequently asked questions

Can I check if my OnePlus 13R is vulnerable without installing any tools?

Yes. Go to Settings → Apps → Show system apps, locate the "OnePlus Account" app, and see if it lists the permission "com.oneplus.account.READ_ACCOUNT_INFO" as granted to other apps; if it does, the device is vulnerable.

Will a factory reset remove the malicious token if my phone is compromised?

A factory reset clears all installed third‑party apps, so the malicious app that harvested the token would be removed. However, if the attacker already used the token to alter cloud data, those changes persist in the OnePlus Cloud and must be manually reverted.

How do I know if an app on the Play Store is trying to exploit this flaw?

Check the app’s permission list; any app requesting "com.oneplus.account.READ_ACCOUNT_INFO" is a red flag. Security‑focused app stores or scanning tools can also highlight suspicious permission usage.

Is this vulnerability limited to the OnePlus 13R model?

The research focused on the OnePlus 13R because that model ships with the vulnerable com.oneplus.account version, but other OnePlus devices that include the same app component could be affected as well.

What steps should enterprises take to protect managed OnePlus devices?

Enterprises should enforce a whitelist of approved applications, disable installation from unknown sources, monitor for the risky permission, and prioritize rapid OTA deployment of OnePlus’s forthcoming patch across all managed devices.