{"id":"CVE-2026-92173","published":"2026-09-30T21:17:17.207","lastModified":"2026-10-01T19:17:25.630","description":"Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-923"],"vendors":[],"products":[],"references":[{"url":"https://www.facebook.com/security/advisories/cve-2026-92173","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows an attacker to send a privileged PendingIntent to an arbitrary application, enabling impersonation of the com.oculus.vrshell package and its signed packages, posing a significant security risk.","exploitability":"Exploitation requires诱导目标应用监听NotificationListenerService，难度较高，需满足特定条件。","blast_radius":"若被利用，攻击者可绕过身份验证机制，对整个操作系统内的相关端点造成严重影响。","remediation":"Upgrade to v74.0.0.878.1682 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","impersonation","os","vr","oculus"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:46:47.293Z"}}