Description
Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication.
Published:
2026-09-30
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Meta Platforms, Inc | Meta Horizon OS | unaffected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
| Link | Providers |
|---|---|
| https://www.facebook.com/security/advisories/cve-2026-92173 |
|
History
Wed, 30 Sep 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication. | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Meta
Published:
Updated: 2026-09-30T20:26:33.293Z
Reserved: 2026-09-15T17:32:03.673Z
Link: CVE-2026-92173
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-30T21:17:17.207
Modified: 2026-09-30T21:17:17.207
Link: CVE-2026-92173
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.