Researcher demonstrates arbitrary code execution on Meta Ray-Ban smart glasses
Original title: Hacking the meta ray-ban smartglasses
The researcher achieved shell access on Meta Ray-Ban smart glasses using firmware extraction and self-signed APK installation, bypassing signature checks in versions up to 126.
The article details a successful hack on Meta Ray-Ban smart glasses targeting pwn2own 2026. By extracting full firmware via OTA updates and hooking app code, the researcher installed a self-signed DAT APK to gain a bind shell on TCP 31337 via WiFi Direct. The vulnerability in firmware verification was patched in version 127.
- Achieved arbitrary code execution on Meta Ray-Ban smart glasses
- Used OTA firmware update to extract full firmware
- Hooked GraphQL fields to force full update
- Installed self-signed DAT APK since no signature check in firmware 126
- Got shell via hooked CameraAccess app
- Vendors
- Meta
- Products
- Ray-Ban smart glasses
From the original article
6 min read at p0pcycle.com
Back in July I wanted to check out the pwn2own targets for 2026. Since the rules hadn’t been released yet, I decided I would check last year’s targets in the hope that it would be similar. Imagine my surprise when I managed to get arbitrary code execution on the glasses and they weren’t in the wearables category anymore :’).
By p0pcycle.com via ni5arga · p0pcycle.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.