CVE-2026-92173 Privilege escalation in Meta Horizon OS
An attacker can exploit a flaw in MediaSyncJobReceiver to impersonate privileged system packages, enabling privilege escalation and security bypasses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92173?
CVE-2026-92173 is a critical vulnerability in Meta Horizon OS, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication.
Weakness: CWE-923
Which versions are affected by CVE-2026-92173?
How do I fix CVE-2026-92173?
No fix has been published for CVE-2026-92173 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92173 being exploited?
There is no known exploitation of CVE-2026-92173 in the wild and no public exploit code.
Sources
Also known as GHSA-x7qm-j22r-cgcw.