Vulnerability · Published Sep 30, 2026 · Assigned by Meta

CVE-2026-92172

High 8.8

In plain English

A high-severity security flaw in Meta Horizon OS from Meta Platforms, Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.3%top 78.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication.

Affected products (as reported)

Vendor	Product	Versions
Meta Platforms, Inc	Meta Horizon OS	v0.0.0.0.0 – before v66.0.0.733.524

Weakness: CWE-923 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.facebook.com/security/advisories/cve-2026-92172 x_refsource_CONFIRM