Meta Horizon OS: Improper restriction of communication channel
Summary
Meta Horizon OS before v74.0.0.878.1682, used on Meta Quest headsets, is affected. MediaSyncJobReceiver can be induced to send a privileged PendingIntent with a com.oculus.vrshell CallerIdentity to any app that uses NotificationListenerService. That app can impersonate com.oculus.vrshell and packages signed with the same key towards OS endpoints that use CallerIdentity authentication. The attack depends on a malicious or compromised app being installed and granted notification access; the CVSS network vector is the CNA's rating and should be treated with caution.
Affected
- Meta Horizon OS below v74.0.0.878.1682 (CNA range: v0.0.0.0.0 up to, but not including, v74.0.0.878.1682)
- Note: one VulDB entry names 66.0.0.733.524, which appears to be a mix-up with CVE-2026-92172; verify against Meta's advisory
Fixed in
- Meta Horizon OS v74.0.0.878.1682 or later
Workaround
Unknown. No vendor workaround is documented in the sources reviewed. Update the firmware.
Exploitation
- Exploited in the wild: not known
- Not listed in CISA KEV
- No public proof of concept found
- EPSS about 0.003 (below 1%)
- CISA SSVC: automatable yes, technical impact total
Our recommendation
- Update all Quest headsets to Meta Horizon OS v74.0.0.878.1682 or later
- Review which apps have notification access on business headsets and remove unneeded apps
- Restrict installation of unknown APKs in managed fleets
- Check Meta's vendor advisory for final affected-version details
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Meta security advisory CVE-2026-92173 www.facebook.com
- OpenCVE CVE-2026-92173 app.opencve.io
- VulDB CVE-2026-92173 vuldb.com
- VulDB entry 412404 vuldb.com
- Vulners VulnCheck record CVE-2026-92173 vulners.com
- Offseq radar CVE-2026-92173 radar.offseq.com
- Wikipedia: Meta Horizon OS en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:47.
Original description (NVD)
Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.