CVE-2026-92172: High severity Meta Horizon OS vulnerability
Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication.
Affected Software
Event History
Frequently Asked Questions
Which devices or OS versions are affected?
Meta Horizon OS versions prior to v66.0.0.733.524 are affected. The provided information does not identify specific device models.
What must an attacker control to exploit this issue?
An attacker needs an application that registers a broadcast receiver for com.oculus.systemactivities.SCREENSHOT. OVRMediaService can then be induced to send that application a privileged PendingIntent containing a com.oculus.horizon CallerIdentity.
What could a successful exploit enable?
The receiving application could impersonate the com.oculus.horizon package to OS endpoints that use CallerIdentity authentication. The data does not specify which endpoints are reachable or what actions they permit.
How can I determine whether a device may be affected?
Check the installed Meta Horizon OS version. Devices running a version earlier than v66.0.0.733.524 may be affected; devices at that version or later are not identified as affected by the provided information.