Prior to v66.0.0.733.524 of Meta Horizon OS the OVRMediaService could be induced to send a privileged PendingIntent that carries a com.oculus.horizon CallerIdentity to any application that has registered a broadcast receiver for com.oculus.systemactivities.SCREENSHOT. The attacker can then impersonate the com.oculus.horizon package when communicating with any OS component that relies on CallerIdentity authentication. The effect is that a non‑privileged app may gain elevated privileges and access protected resources within the operating system.

Meta Platforms, Inc. Horizon OS versions prior to v66.0.0.733.524 are affected. The flaw resides in the OVRMediaService component in those releases.

Because the vulnerability requires the attacker only to install an application that registers a broadcast receiver for com.oculus.systemactivities.SCREENSHOT, any app on the device can execute the attack. The EPSS score of <1% indicates a very low probability of exploitation, but the CVSS score of 8.8 indicates a high severity. The vulnerability could lead to full privilege escalation and compromise confidentiality, integrity, and availability. The KEV listing does not contain this vulnerability, and there is no known exploitation, but the inherent risk remains high.