CVE-2026-92173: Meta Horizon OS vulnerability
Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication.
Affected Software
Event History
Frequently Asked Questions
Which devices or deployments are affected?
Meta Horizon OS versions prior to v74.0.0.878.1682 are affected. The issue involves applications able to receive notifications through NotificationListenerService.
What must an attacker-controlled application be able to do?
It must be an arbitrary application listening through NotificationListenerService and able to induce MediaSyncJobReceiver to send the privileged PendingIntent. The resulting CallerIdentity can be used against OS endpoints that authenticate callers using CallerIdentity.
What identity could an attacker impersonate?
The application could impersonate the com.oculus.vrshell package, as well as other packages signed with the same key, toward affected OS endpoints.
How can the issue be remediated?
Update Meta Horizon OS to v74.0.0.878.1682 or later.