CVE-2026-92172

Awaiting Analysis Awaiting Analysis - Queue

Privileged PendingIntent Exposure in Meta Horizon OS

Publication date: 2026-09-30

Last updated on: 2026-10-01

Assigner: Facebook, Inc.

Description

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-01

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92172

EUVD

EUVD-2026-90316

Affected Vendors & Products

Vendor	Product	Version / Range
meta	horizon_os	*
ovrmediaservice	ovrmediaservice	*
oculus	calleridentity	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-923	The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Attack-Flow Graph

Executive Summary

This vulnerability involves Meta Horizon OS versions before v66.0.0.733.524 where OVRMediaService could send a privileged PendingIntent with a com.oculus.horizon CallerIdentity to any app registering for com.oculus.systemactivities.SCREENSHOT. This allows the receiving app to impersonate the com.oculus.horizon package for authentication within the OS.

Detection Guidance

This vulnerability involves a broadcast receiver in Meta Horizon OS that could be exploited to send a privileged PendingIntent. Detection requires checking for unauthorized applications registering for com.oculus.systemactivities.SCREENSHOT or inspecting OVRMediaService logs for suspicious PendingIntent transmissions. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to impersonate a trusted system component, potentially gaining unauthorized access to sensitive data or system functions within Meta Horizon OS.

Compliance Impact

The vulnerability allows an arbitrary application to impersonate a privileged system component (com.oculus.horizon) via CallerIdentity authentication. This could enable unauthorized access to sensitive data or system functions, potentially violating data protection requirements under GDPR (e.g., unauthorized data access) and HIPAA (e.g., unauthorized disclosure of protected health information).

Mitigation Strategies

Update Meta Horizon OS to version v66.0.0.733.524 or later to address the vulnerability in OVRMediaService.

Hi! I’m here to help you understand CVE-2026-92172. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70