{
  "id": 18564727,
  "title": "Hacking the meta ray-ban smartglasses",
  "url": "https://urgent.news/2026/11/06/hacking-the-meta-ray-ban-smartglasses",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-06T20:50:24.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://p0pcycle.com/2026/11/06/hacking-the-meta-ray-ban-smartglasses/"
  },
  "original_language": "en",
  "account": "In July 2023, the author wanted to investigate the pwn2own targets for 2026. Since the rules had not been released, they decided to examine last year's targets, hoping they would be similar. To their surprise, they successfully gained arbitrary code execution on the Meta Ray-Ban smartglasses, but they were not classified in the wearables category. The author reported the vulnerability to Meta, and after some negotiation, they agreed to a new payout.\n\nThe author began by acquiring the smartglasses, which were provided by their brother-in-law. They installed the Meta AI app, which controls the glasses, and extracted the firmware using the over-the-air (OTA) update. The OTA update process was analyzed using JADX, and the author found that the update URL contained a zip file. By hooking into the OTAArtifactInfo() function, they could print the CDN update URL.\n\nThe zip file contained an Android update, including the payload.bin. The author dumped the payload.bin using payload-dumper and mounted the files into a filesystem. Firmware 126 was discovered, which did not verify the signature of the DAT APK, allowing the author to install a self-signed application. This enabled the author to run any app on the glasses using Frida to swap the legitimate DAT application.\n\nTo debug the process, the author used android.media.ToneGenerator to signal the execution of their code. They installed a sample app called Camera Access, which created a DAT session with the glasses. By hooking into the startDwaReadinessProbe() function, the author could monitor the connection and disable the timeout. This allowed them to establish an interactive shell on the glasses via TCP 31337. However, firmware 127 enforced signature verification of the DAT apk, making it impossible to self-sign the application.",
  "summary": null,
  "key_points": [
    "Author successfully gained arbitrary code execution on Meta Ray-Ban smartglasses in July 2023.",
    "Vulnerability reported to Meta, resulting in a new payout after negotiation.",
    "Signature verification enforced in firmware 127 prevents self-signing applications."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}