EUVD-2026-90315

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the...

CVE-2026-92173

Meta Horizon OS versions prior to v74.0.0.878.1682 are vulnerable because the MediaSyncJobReceiver can be induced to send a privileged PendingIntent to an arbitrary application via NotificationListenerService . This flaw includes a com.oculus.vrshell CallerIdentity , enabling the receiving applic...