Meta Horizon Os
Monthly
Local privilege escalation in Meta Horizon OS prior to v66.0.0.733.524 allows a malicious on-device application to register a broadcast receiver for com.oculus.systemactivities.SCREENSHOT and receive a privileged PendingIntent containing a com.oculus.horizon CallerIdentity, which can then be used to impersonate that package to OS endpoints that rely on CallerIdentity authentication. The attack requires the malicious app to already be installed and running on the same device, via sideloading or a malicious store app; there is no remote network-only path in the authoritative assessment. No public exploit was identified at time of analysis, EPSS is low at 0.23% (13th percentile), and the available fix is Meta Horizon OS v66.0.0.733.524.
Meta Horizon OS versions prior to v74.0.0.878.1682 allow a locally installed malicious application that has been granted notification-access to impersonate the privileged com.oculus.vrshell package - and any other package signed with the same signing key - against OS endpoints that authenticate callers via CallerIdentity, producing high confidentiality and integrity impact. The root cause is an improper communication-channel restriction (CWE-923) in MediaSyncJobReceiver, which can be induced to send a privileged PendingIntent carrying a com.oculus.vrshell CallerIdentity to any application registered as a NotificationListenerService. Although the supplied NVD score is 9.1 with an AV:N vector, the realistic attack path is a local, on-device app-to-app attack that requires an attacker-controlled listener already resident on the device; EPSS is low (0.23%, 13th percentile) and no confirmed active exploitation (CISA KEV) or public exploit code was identified at time of analysis.
Local privilege escalation in Meta Horizon OS prior to v66.0.0.733.524 allows a malicious on-device application to register a broadcast receiver for com.oculus.systemactivities.SCREENSHOT and receive a privileged PendingIntent containing a com.oculus.horizon CallerIdentity, which can then be used to impersonate that package to OS endpoints that rely on CallerIdentity authentication. The attack requires the malicious app to already be installed and running on the same device, via sideloading or a malicious store app; there is no remote network-only path in the authoritative assessment. No public exploit was identified at time of analysis, EPSS is low at 0.23% (13th percentile), and the available fix is Meta Horizon OS v66.0.0.733.524.
Meta Horizon OS versions prior to v74.0.0.878.1682 allow a locally installed malicious application that has been granted notification-access to impersonate the privileged com.oculus.vrshell package - and any other package signed with the same signing key - against OS endpoints that authenticate callers via CallerIdentity, producing high confidentiality and integrity impact. The root cause is an improper communication-channel restriction (CWE-923) in MediaSyncJobReceiver, which can be induced to send a privileged PendingIntent carrying a com.oculus.vrshell CallerIdentity to any application registered as a NotificationListenerService. Although the supplied NVD score is 9.1 with an AV:N vector, the realistic attack path is a local, on-device app-to-app attack that requires an attacker-controlled listener already resident on the device; EPSS is low (0.23%, 13th percentile) and no confirmed active exploitation (CISA KEV) or public exploit code was identified at time of analysis.