CVE-2026-92172 — Meta Platforms, Inc / Meta Horizon OS

Description (CNA)

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication.

Affected (CNA)

Vendor / product	Versions
Meta Platforms, Inc / Meta Horizon OS	affected v0.0.0.0.0 before v66.0.0.733.524

CWE

No CWE identifiers supplied.

References

https://www.facebook.com/security/advisories/cve-2026-92172

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.