Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for Meta Horizon OS by Meta Platforms, Inc

    CVE-2026-92173 (GCVE-0-2026-92173)

    Vulnerability from nvd – Published: 2026-09-30 20:26 – Updated: 2026-09-30 20:26
    VLAI
    Summary
    Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication.
    Severity
    No CVSS data available.
    CWE
    • Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Meta Platforms, Inc Meta Horizon OS Affected: v0.0.0.0.0 , < v74.0.0.878.1682 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Meta Horizon OS",
          "vendor": "Meta Platforms, Inc",
          "versions": [
            {
              "lessThan": "v74.0.0.878.1682",
              "status": "affected",
              "version": "v0.0.0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T20:26:33.293Z",
        "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
        "shortName": "Meta"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.facebook.com/security/advisories/cve-2026-92173"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
    "assignerShortName": "Meta",
    "cveId": "CVE-2026-92173",
    "datePublished": "2026-09-30T20:26:33.293Z",
    "dateReserved": "2026-09-15T17:32:03.673Z",
    "dateUpdated": "2026-09-30T20:26:33.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92172 (GCVE-0-2026-92172)

    Vulnerability from nvd – Published: 2026-09-30 20:26 – Updated: 2026-09-30 20:26
    VLAI
    Summary
    Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication.
    Severity
    No CVSS data available.
    CWE
    • Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Meta Platforms, Inc Meta Horizon OS Affected: v0.0.0.0.0 , < v66.0.0.733.524 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Meta Horizon OS",
          "vendor": "Meta Platforms, Inc",
          "versions": [
            {
              "lessThan": "v66.0.0.733.524",
              "status": "affected",
              "version": "v0.0.0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T20:26:49.629Z",
        "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
        "shortName": "Meta"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.facebook.com/security/advisories/cve-2026-92172"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
    "assignerShortName": "Meta",
    "cveId": "CVE-2026-92172",
    "datePublished": "2026-09-30T20:26:49.629Z",
    "dateReserved": "2026-09-15T17:32:03.673Z",
    "dateUpdated": "2026-09-30T20:26:49.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92172 (GCVE-0-2026-92172)

    Vulnerability from cvelistv5 – Published: 2026-09-30 20:26 – Updated: 2026-09-30 20:26
    VLAI
    Summary
    Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication.
    Severity
    No CVSS data available.
    CWE
    • Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Meta Platforms, Inc Meta Horizon OS Affected: v0.0.0.0.0 , < v66.0.0.733.524 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Meta Horizon OS",
          "vendor": "Meta Platforms, Inc",
          "versions": [
            {
              "lessThan": "v66.0.0.733.524",
              "status": "affected",
              "version": "v0.0.0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T20:26:49.629Z",
        "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
        "shortName": "Meta"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.facebook.com/security/advisories/cve-2026-92172"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
    "assignerShortName": "Meta",
    "cveId": "CVE-2026-92172",
    "datePublished": "2026-09-30T20:26:49.629Z",
    "dateReserved": "2026-09-15T17:32:03.673Z",
    "dateUpdated": "2026-09-30T20:26:49.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-92173 (GCVE-0-2026-92173)

    Vulnerability from cvelistv5 – Published: 2026-09-30 20:26 – Updated: 2026-09-30 20:26
    VLAI
    Summary
    Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication.
    Severity
    No CVSS data available.
    CWE
    • Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Meta Platforms, Inc Meta Horizon OS Affected: v0.0.0.0.0 , < v74.0.0.878.1682 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Meta Horizon OS",
          "vendor": "Meta Platforms, Inc",
          "versions": [
            {
              "lessThan": "v74.0.0.878.1682",
              "status": "affected",
              "version": "v0.0.0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T20:26:33.293Z",
        "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
        "shortName": "Meta"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.facebook.com/security/advisories/cve-2026-92173"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
    "assignerShortName": "Meta",
    "cveId": "CVE-2026-92173",
    "datePublished": "2026-09-30T20:26:33.293Z",
    "dateReserved": "2026-09-15T17:32:03.673Z",
    "dateUpdated": "2026-09-30T20:26:33.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}