New bootloader lets you take the "Meta" out of the original Meta Quest

Privilege escalation attack grants “full control” and freedom from Meta’s servers/apps.

Tinkerers are also in the early stages of figuring out how root access can unlock previously unavailable features on the Quest hardware. That includes activating the 90 Hz refresh rate that John Carmack admitted in 2019 was being held back to 72 Hz in the OS for performance reasons. There are also projects in the works to get other VR controllers working with the original Quest.

In 2021, Meta’s then-CTO John Carmack released an official “full root access” update for the Oculus Go, the Quest’s wireless predecessor. At the time, Carmack said he hoped that update would allow tinkerers to “repurpose the [Go] hardware for more things today” and ensure that “a randomly discovered shrink wrapped [Go] headset twenty years from now [would] be able to update to the final software version, long after over-the-air update servers have been shut down.”

QuestStack author starseed12345 speculates on GitHub that a similar exploit could probably enable root access on Quest 2 headsets running older firmware versions but that currently “the chance of bricking outweighs the benefit of unlocking the bootloader.”