EUVD-2026-90316
GHSA-jg3q-pm4q-v527
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack is local on-device IPC (AV:L) by an unprivileged app (PR:N); impersonating a system package across OS endpoints crosses a trust boundary (S:C) yielding high C/I, with no availability impact.
Primary rating from Vendor (Meta).
CVSS VectorVendor: Meta
Lifecycle Timeline
4DescriptionCVE.org
Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication.
AnalysisAI
Local privilege escalation in Meta Horizon OS prior to v66.0.0.733.524 allows a malicious on-device application to register a broadcast receiver for com.oculus.systemactivities.SCREENSHOT and receive a privileged PendingIntent containing a com.oculus.horizon CallerIdentity, which can then be used to impersonate that package to OS endpoints that rely on CallerIdentity authentication. The attack requires the malicious app to already be installed and running on the same device, via sideloading or a malicious store app; there is no remote network-only path in the authoritative assessment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a malicious application to be installed and running on the same Meta Horizon OS device, which registers a broadcast receiver for the com.oculus.systemactivities.SCREENSHOT action; the flaw is only exploitable prior to v66.0.0.733.524. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (8.8, AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) rates this as High, but the signals are more consistent with a locally-exploitable, on-device privilege-escalation issue than a remotely-reachable network flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Meta Horizon OS to v66.0.0.733.524 or later, the vendor-released patched version identified in the advisory at https://www.facebook.com/security/advisories/cve-2026-92172. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Meta Horizon Os
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today