Security researcher Paula, known online as pamoutaf, bypassed safeguards on Ray-Ban Meta smart glasses and ran software that was not authorized by Meta. The research shows that a person controlling a paired smartphone could replace the glasses’ official Device Access Toolkit with a modified application, according to reporting on the disclosure. [1]
The initial weakness affected firmware version 126 and earlier, which did not verify that the toolkit’s Android package had been signed by Meta. Meta added signature enforcement in firmware 127, but the researcher found that the control enabling the check was delivered in a configuration file from the phone. The glasses validated the file’s structure without validating its integrity, allowing a single-byte change to disable the protection and restore installation of a self-signed package. [1]
After loading the modified software, Paula sent commands to the glasses wirelessly from the paired phone and obtained shell access for her testing. The demonstration required control of, or substantial access to, the owner’s phone and glasses; it was not presented as a zero-click over-the-air attack against random people wearing the devices. The research therefore demonstrates a local or supply-chain-style control risk rather than a proven remote compromise of unattended glasses.
The security implications are nevertheless significant because Ray-Ban Meta glasses combine a camera, microphones and wireless connectivity in a device designed to remain on a wearer’s face. Unauthorized software could potentially interact with sensors or stored media, although the published research does not establish that an attacker can covertly exfiltrate recordings or operate every device function. The available reporting also does not identify a CVE, CVSS score, exploitation campaign or threat actor tied to the issue. [1]
Owners should install the latest available glasses firmware and Meta AI app updates, avoid unofficial software and refrain from modifying the device. Meta’s own safety guidance warns that unauthorized software or hacking can create performance, damage and safety problems and may affect warranty coverage. [11] The episode also highlights a broader design requirement for wearables: security decisions must be enforced on the device and protected with authenticated configuration data, rather than delegated to an untrusted paired phone.
References
- Ray-Ban Meta smart glasses hack lets researcher run code
- Health And Safety Warnings | Meta Ray-Ban Display | Meta
