CVE-2014-8609-POC

CVE-2014-8609-POC -pendingintent vulnerability Explanation of how the vulnerability works with exploitation method. It is one of the most common vulnerabilities in Android applications, and you can use it to access more vulnerabilities in a professional way. POC...

CVE-2026-92173

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the...

CVE-2026-92172

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the...

CVE-2026-92172

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the...

CVE-2026-92172

Prior to version v66.0.0.733.524 of Meta Horizon OS , a vulnerability exists where OVRMediaService can be induced to send a privileged PendingIntent containing a com.oculus.horizon CallerIdentity . This occurs when an arbitrary application registers for the com.oculus.systemactivities.SCREENSHOT ...

CVE-2026-92172

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the...

CVE-2026-92173

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the...

CVE-2026-92173

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the...

EUVD-2026-90315

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the...

CVE-2026-92173

Meta Horizon OS versions prior to 74.0.0.878.1682 are vulnerable to a flaw in MediaSyncJobReceiver . An attacker can induce this component to send a privileged PendingIntent containing a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService . This...

CVE-2026-92173: Improper Restriction of Communication Channel to Intended Endpoints

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the...

CVE-2026-92172: Improper Restriction of Communication Channel to Intended Endpoints

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the...

PT-2026-103605

Name of the Vulnerable Software and Affected Versions Meta Horizon OS versions prior to 66.0.0.733.524 Description OVRMediaService can be induced to send a privileged PendingIntent containing a com.oculus.horizon CallerIdentity to any application that registers for...

PT-2026-103606

Name of the Vulnerable Software and Affected Versions Meta Horizon OS versions prior to 74.0.0.878.1682 Description An issue exists where the MediaSyncJobReceiver can be induced to send a privileged PendingIntent containing a com.oculus.vrshell CallerIdentity to an arbitrary application that is...

CVE-2026-45528

In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2026-45528

In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

EUVD-2026-74003

In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2026-45528

In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2026-45528

A vulnerability exists in the StorageManagerService.java component within the getManageSpaceActivityIntent function. This is caused by an unsafe PendingIntent , which could enable a LaunchAnyWhere chain. Successful exploitation could result in a local escalation of privilege without requiring add...

PT-2026-88241

Name of the Vulnerable Software and Affected Versions StorageManagerService affected versions not specified Description An unsafe PendingIntent in the getManageSpaceActivityIntent function of StorageManagerService.java allows for a LaunchAnyWhere chain. This issue could enable local escalation of...