Arbitrary Code Execution Achieved on Meta Ray-Ban Smartglasses

A researcher achieved arbitrary code execution on Meta Ray-Ban smartglasses by exploiting firmware extraction and application signing vulnerabilities. After acquiring a pair, they extracted the complete Android firmware by reverse-engineering Meta’s AI control app with JADX and manipulating OTA update requests through hooked GraphQL fields to retrieve full rather than incremental firmware updates.

The primary exploit chain targeted the Device Access Toolkit (DAT) ecosystem. Through firmware 126, the installation process failed to verify DAT application signatures, allowing the researcher to use Frida to inject a self-signed app. Lacking any display output mechanism, they used ToneGenerator to produce beep sequences indicating progress before establishing TCP shell access via the 192.168.49.x Wi-Fi Direct network used for device syncing.

When firmware 127 introduced signature enforcement, a secondary vulnerability became critical. The signature verification flag (wss_appmanager.signature_verification_enabled) arrives via MobileConfig, a remote configuration system that only validates structural integrity without tampering checks. By modifying a single byte in the 0.mctable file from 0x80 to 0x00, the researcher disabled signature verification and reinstalled their application. They reported the findings to Meta and agreed to their bounty payout.