EUVD-2026-90315
GHSA-x7qm-j22r-cgcw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Requires a locally installed listener app so AV:L; no extra privileges (PR:N); impersonation crosses into other packages'/OS trust so S:C with high confidentiality and integrity, no availability impact.
Primary rating from Vendor (Meta).
CVSS VectorVendor: Meta
Lifecycle Timeline
4DescriptionCVE.org
Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication.
AnalysisAI
Meta Horizon OS versions prior to v74.0.0.878.1682 allow a locally installed malicious application that has been granted notification-access to impersonate the privileged com.oculus.vrshell package - and any other package signed with the same signing key - against OS endpoints that authenticate callers via CallerIdentity, producing high confidentiality and integrity impact. The root cause is an improper communication-channel restriction (CWE-923) in MediaSyncJobReceiver, which can be induced to send a privileged PendingIntent carrying a com.oculus.vrshell CallerIdentity to any application registered as a NotificationListenerService. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a malicious application already installed on the Meta Horizon OS device that is registered as a NotificationListenerService (which normally requires the user to grant notification-access) so it can receive the privileged PendingIntent emitted by MediaSyncJobReceiver. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) reflects a severe confidentiality and integrity impact via identity impersonation, but the attack vector is questionable: the description requires a malicious application already installed on the device and registered as a NotificationListenerService to receive the leaked privileged PendingIntent - this is an on-device, app-to-app attack, NOT a remote network-reachable one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: v74.0.0.878.1682 - Meta Horizon OS devices should be updated to v74.0.0.878.1682 or later, which is the fixed release for CVE-2026-92173; the vendor advisory is at https://www.facebook.com/security/advisories/cve-2026-92173 and the issue is tracked as EUVD-2026-90315. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Meta Horizon OS devices to identify those running versions prior to v74.0.0.878.1682 and assess whether notification access is granted to any non-essential applications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Meta Horizon Os
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today