Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Meta Platforms, Inc | Meta Horizon OS | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://www.facebook.com/security/advisories/cve-2026-92173 |
|
Wed, 30 Sep 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Privileged PendingIntent allows CallerIdentity impersonation in Meta Horizon OS | |
| Weaknesses | CWE-269 |
Wed, 30 Sep 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication. | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Meta
Published:
Updated: 2026-09-30T20:26:33.293Z
Reserved: 2026-09-15T17:32:03.673Z
Link: CVE-2026-92173
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-30T21:17:17.207
Modified: 2026-09-30T21:17:17.207
Link: CVE-2026-92173
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-30T22:30:07Z