Unrated severityNVD Advisory· Published Sep 30, 2026

CVE-2026-92172

Description

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Meta/Horizon OSllm-create
Range: <66.0.0.733.524
Meta/OVRMediaServicellm-create
Range: <66.0.0.733.524

Patches

Vulnerability mechanics

References

www.facebook.com/security/advisories/cve-2026-92172nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000