GoKawiilSecurity researcher achieves arbitrary code execution on Meta Ray-Ban smartglasses
A researcher reverse-engineered Meta's AI companion app to intercept the over-the-air firmware update process for Meta Ray-Ban smartglasses, extracting a CDN download URL for the firmware. Using this access, they achieved arbitrary code execution on the device and reported the vulnerability to Meta through its bug bounty program, eventually agreeing on a payout after negotiation.
GoKawiil's interpretation of the reporting above, not reported fact.
The researcher notes that no one had successfully targeted the glasses at last year's Pwn2Own competition, suggesting the device was considered well-hardened against attacks. This disclosure indicates that wearable AI devices with network connectivity and update mechanisms may carry security risks similar to smartphones, which could prompt further scrutiny of firmware update processes across the smart-glasses category.
- A researcher found a way to achieve arbitrary code execution on Meta Ray-Ban smartglasses via the firmware OTA update mechanism.
- The attack path involved reverse-engineering the Meta AI companion app using JADX to locate and extract a CDN firmware download URL.
- The finding was disclosed to Meta through a bug bounty process, resulting in an agreed payout.
Source: p0pcycle.com — Paul Jones, 2026-11-07
Published there as: “Hacking the meta ray-ban smartglasses”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.