Oppo
12 CVEs across 79 Oppo products. Browse Oppo vulnerabilities, severities, and proof-of-concept exploits.
Oppo products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22078 | High | 7.3 | 2026-06-29 | Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC cha… |
CVE-2026-22070 | High | 7.1 | 2026-04-30 | ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal. |
CVE-2026-22077 | | 2026-04-27 | OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account to… | |
CVE-2025-27388 | | 2025-08-14 | Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens. | |
CVE-2025-27387 | High | 7.4 | 2025-06-23 | OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure. |
CVE-2024-1609 | | 2024-12-25 | In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation. | |
CVE-2024-1610 | Critical | 9.8 | 2024-12-18 | In OPPO Store APP, there's a possible escalation of privilege due to improper input validation. |
CVE-2024-1608 | Critical | 9.1 | 2024-02-20 | In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application internal information le… |
CVE-2023-26311 | High | 7.4 | 2023-08-10 | A remote code execution vulnerability in the webview component of OPPO Store app. |
CVE-2023-26309 | High | 7.4 | 2023-08-10 | A remote code execution vulnerability in the webview component of OnePlus Store app. |
CVE-2023-26310 | High | 7.4 | 2023-08-09 | There is a command injection problem in the old version of the mobile phone backup app. |
CVE-2021-23247 | Critical | 9.8 | 2022-04-01 | A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code executio… |
CVE-2021-23246 | High | 7.5 | 2022-03-11 | In ACE2 ColorOS11, the attacker can obtain the foreground package name through permission promotion, resulting in user information disclosure. |
CVE-2021-23244 | High | 7.8 | 2021-12-27 | ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelist is not installed… |
CVE-2021-23243 | High | 7.8 | 2021-09-27 | In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be used. |
CVE-2020-11836 | Medium | 5.5 | 2021-02-06 | OPPO Android Phone with MTK chipset and Android 8.1/9/10/11 versions have an information leak vulnerability. The “adb shell getprop ro.vendor.aee.enforcing” or… |
CVE-2020-11835 | Medium | 5.5 | 2020-12-31 | In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/charger_ic/oppo_da9313.c, failure to check the parameter buf in the function proc_work_mode_write in proc_… |
CVE-2020-11834 | Medium | 5.5 | 2020-12-31 | In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/oppo_vooc.c, the function proc_fastchg_fw_update_write in proc_fastchg_fw_update_write does not check the… |
CVE-2020-11833 | Medium | 5.5 | 2020-12-31 | In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/charger_ic/oppo_mp2650.c, the function mp2650_data_log_write in mp2650_data_log_write does not check the p… |
CVE-2020-11832 | Medium | 5.5 | 2020-12-31 | In functions charging_limit_current_write and charging_limit_time_write in /SM8250_Q_Master/android/vendor/oppo_charger/oppo/oppo_charger.c have not checked th… |
CVE-2020-11831 | Critical | 9.8 | 2020-11-19 | OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1. |
CVE-2020-11830 | Critical | 9.8 | 2020-11-19 | QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0. |
CVE-2020-11829 | Critical | 9.8 | 2020-11-19 | Dynamic loading of services in the backup and restore SDK leads to elevated privileges, affected product is com.coloros.codebook V2.0.0_5493e40_200722. |
CVE-2020-11828 | High | 7.5 | 2020-04-21 | In ColorOS (oppo mobile phone operating system, based on AOSP frameworks/native code position/services/surfaceflinger surfaceflinger.CPP), RGB is defined on th… |
CVE-2018-14996 | High | 7.8 | 2019-04-25 | The Oppo F5 Android device with a build fingerprint of OPPO/CPH1723/CPH1723:7.1.1/N6F26Q/1513597833:user/release-keys contains a pre-installed platform app wit… |