Meta Horizon OS: Identity impersonation via OVRMediaService PendingIntent
Summary
Meta Horizon OS before v66.0.0.733.524 contains a flaw in the OVRMediaService component. A malicious application that registers for the screenshot broadcast can receive a privileged PendingIntent carrying the com.oculus.horizon CallerIdentity. The application can then impersonate the Horizon package towards OS endpoints that use CallerIdentity authentication. The attack requires a malicious or compromised app installed on the headset.
Affected
- Meta Horizon OS versions prior to v66.0.0.733.524
- Earlier affected builds: Unknown.
Fixed in
- Meta Horizon OS v66.0.0.733.524 (implied first fixed build, not yet confirmed against the vendor advisory)
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Not listed in CISA KEV.
- No public proof of concept found.
Our recommendation
- Update all Meta Quest headsets to v66.0.0.733.524 or later and enable automatic updates.
- Inventory all headsets and their software versions.
- Allow only trusted apps on business headsets and restrict installation of untrusted third-party apps.
- Priority is higher if headsets hold sensitive data or connect to internal systems.
- Check the CVE record for CVE-2026-86345, which may be a duplicate.
- Check related CVE-2026-92173, which has a fix threshold of v74.0.0.878.1682.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Meta security advisory CVE-2026-92172 www.facebook.com
- OpenCVE CVE-2026-92172 app.opencve.io
- Strix CVE-2026-92172 www.strix.ai
- VulDB CVE-2026-92172 vuldb.com
- Strix CVE-2026-92173 www.strix.ai
- Wikipedia: Meta Horizon OS en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:03.
Original description (NVD)
Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.