CVE-2026-92173CWE-923

CVE-2026-92173

Critical · published October 1, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00288 · 20.2th percentile
Weakness
CWE-923 · Improper Restriction of Communication Channel to Intended Endpoints
Published
2026-10-01T01:17Z
References (1)
https://www.facebook.com/security/advisories/cve-2026-92173 · [email protected]
EPSS history
Timeline
  • 02 OCT 03:47Z
    EPSS moved — → 0%
    epss
  • 30 SEP 20:26Z
    Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell…
    cvelistv5