www.it-connect.fr
Ray-Ban Meta Smart Glasses Hacked: Researcher Gets a Shell, Then Bypasses Meta’s Patch
No screen, no console, no logs. Just a pair of connected sunglasses and, in return, an interactive shell. A security researcher managed to execute arbitrary code on Ray-Ban Meta smart glasses, then bypassed a recently deployed Meta patch. Here’s how she did it.
Last July, this researcher was looking into targets for Pwn2Own Ireland 2026, but without knowing what would actually be allowed as a target at the event. She then relied on the 2025 edition, where Ray-Ban Meta devices were included, with up to $150,000 in rewards for a remote code execution with no interaction. That’s what she managed to do, but unfortunately for her, these smart glasses were not eligible for the 2026 edition.
She therefore reported her discovery to Meta through its bug bounty program. "After disputing the payment several times, we eventually reached an agreement," she says. The bounty amount was not disclosed, but Meta did acknowledge the existence of the security issue.
One important clarification before going into the details of this security flaw: this is not a remote attack. The entire chain relies on hijacking, with Frida, the Meta AI app installed on the smartphone paired with the glasses. In other words, you need control of the phone to abuse the trust relationship between the Meta AI app and the glasses.
From firmware to code execution
First step: retrieve the firmware, meaning the glasses’ operating system, without taking them apart. The researcher turned to the updates that the Meta AI app offers to install via an OTA mechanism. By analyzing the app’s code, then modifying its behavior with Frida, she recovered the download address for the update. But it was only a partial update, containing only the changes compared with the version already installed. By modifying a parameter in the request sent to Meta’s servers, she obtained the full version: she was then able to dissect it!
The next step: gain access. That is where she was able to exploit the Device Access Toolkit (DAT), which Meta opened in preview to developers at the end of 2025, notably to use the glasses’ camera. It relies on a dedicated APK, which the Meta AI app downloads and installs on the fly onto the glasses.
Up to firmware version 126 included, the glasses did not verify that this APK was properly signed by Meta. In theory, any application could therefore be installed there. That is what the researcher did: with Frida, she replaced the legitimate APK with her own application, which she signed herself.
She still needed to know whether her code was actually running on a device with no screen or console. She then had an idea: make the glasses beep. Three beeps at startup, five when the expected network is detected, four when the app is ready to accept a connection, six in case of an error. A bit like Morse code in audio form! These beeps allowed her to spot a blockage, which she bypassed with Frida.
Final step: connect to the glasses. To synchronize photos and videos, the Meta AI app creates a Wi‑Fi Direct network between the phone and the glasses. The researcher forced the glasses to join this network, where her app was waiting for a connection on port 31337. From the phone, a simple command opened a shell for her, that is, command-line access, with the limited privileges of that app. “With great power comes great opsec”, she jokes.
Firmware 127 closes the door, one byte reopens it
That joy, and especially that access, lasted only 5 days! While she was trying to go further, notably with privilege escalation, the researcher lost access to her shell. In reality, firmware 127 pushed by Meta started enforcing signature verification for the DAT APK. This check depends on a simple indicator, enabled or disabled, stored in a configuration file. The phone downloads this file from Meta’s servers and then sends it to the glasses. It allows Meta to change their behavior without pushing a firmware update.
The problem, according to the researcher: the glasses checked that the file was structurally correct, not that it had not been altered. The phone could therefore modify any indicator. By changing one byte from 0x80 to 0x00 (which amounts to switching from “enabled” to “disabled”) in the 0.mctable file, she disabled signature verification and reinstalled her self-signed APK. And just like that, access was restored, and in the process, Meta’s patch was bypassed...!
Thanks to this shell, the researcher says she has started mapping the glasses’ attack surface... and she should share more about it soon. No CVE identifier is specified in her report, and Meta does not appear to have communicated about this finding. "They approved my blog post, which leads me to believe it is now fixed," she writes.
For Ray-Ban Meta owners, the risk remains limited as long as no one takes control of their smartphone. Still, it raises real questions, given that this accessory is packed with microphones and a camera. Find all the technical details on the researcher’s blog.
