CVE-2026-92172

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the...

CVE-2026-92173

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the...

CVE-2026-92172

Versions of Meta Horizon OS prior to v66.0.0.733.524 are vulnerable to an issue where the OVRMediaService can be induced to send a privileged PendingIntent . By registering for the com.oculus.systemactivities.SCREENSHOT broadcast receiver, an arbitrary application can receive a com.oculus.horizon...

EUVD-2026-90316

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the...

EUVD-2026-90315

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the...

CVE-2026-92173

Meta Horizon OS versions prior to v74.0.0.878.1682 are vulnerable because the MediaSyncJobReceiver can be induced to send a privileged PendingIntent to an arbitrary application via NotificationListenerService . This flaw includes a com.oculus.vrshell CallerIdentity , enabling the receiving applic...