A vulnerable component in Meta Horizon OS older0.878.1682 constructs a privileged PendingIntent that carries a caller identity belonging to the com.oculus.vrshell package. Because the system fails to properly restrict this operation, the intent can be delivered to any application that registers a NotificationListenerService, allowing that application to appear as the trusted com.oculus.vrshell or any package signed with the same key. This weakness aligns with CWE‑923 and enables an attacker to impersonate a trusted OS component and access any endpoint that uses CallerIdentity authentication, compromising confidentiality, integrity, and potentially availability of privileged actions.

Meta Platforms, Inc:Meta Horizon OS, versions prior to v74.0.0.878.1682. The vulnerability is confined to this product family; no other vendors or products are affected.

The CVSS score of 9.1 indicates critical severity, while the EPSS score of <1% suggests low overall exploit probability at present. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to craft a malicious PendingIntent and have their application registered as a NotificationListenerService. Once the privileged intent reaches the listener, the app would be treated as the com.oculus.vrshell identity and could perform any CallerIdentity‑protected actions on the device.