Vulnerability · Published Sep 30, 2026 · Assigned by Meta

CVE-2026-92173

Critical 9.1

In plain English

A critical-severity security flaw in Meta Horizon OS from Meta Platforms, Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.3%top 78.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication.

Affected products (as reported)

Vendor	Product	Versions
Meta Platforms, Inc	Meta Horizon OS	v0.0.0.0.0 – before v74.0.0.878.1682

Weakness: CWE-923 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://www.facebook.com/security/advisories/cve-2026-92173 x_refsource_CONFIRM