CVE-2026-92172

Received Received - Intake

Privileged PendingIntent Exposure in Meta Horizon OS

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Facebook, Inc.

Description

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-92172

EUVD

EUVD-2026-90316

Affected Vendors & Products

Vendor	Product	Version / Range
meta	horizon_os	*
ovrmediaservice	ovrmediaservice	*
oculus	calleridentity	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves Meta Horizon OS versions before v66.0.0.733.524 where OVRMediaService could send a privileged PendingIntent with a com.oculus.horizon CallerIdentity to any app registering for com.oculus.systemactivities.SCREENSHOT. This allows the receiving app to impersonate the com.oculus.horizon package for authentication within the OS.

Impact Analysis

An attacker could exploit this to impersonate a trusted system component, potentially gaining unauthorized access to sensitive data or system functions within Meta Horizon OS.

Mitigation Strategies

Update Meta Horizon OS to version v66.0.0.733.524 or later to address the vulnerability in OVRMediaService.

Hi! I’m here to help you understand CVE-2026-92172. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70