CVE-2026-92172

Summary

The flaw allows an attacker to send a privileged PendingIntent to an arbitrary application, enabling impersonation of the com.oculus.horizon package within the OS.

Exploitability

Exploitation requires inducing the OVRMediaService to send a PendingIntent, which may be difficult without specific conditions or access.

Blast radius

If exploited, the impact could be severe, as it allows an application to impersonate the com.oculus.horizon package, potentially leading to unauthorized access to sensitive OS functionalities.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to v66.0.0.733.524 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.