New bootloader frees the original Meta Quest from Meta's servers
Developers have found a privilege escalation method that grants full control over the original Meta Quest headset, letting it operate independently of Meta's servers and apps. Tinkerers are now exploring what previously locked features root access could unlock.
A group of tinkerers has developed a way to gain full control over the software running on the original Meta Quest virtual reality headset by exploiting a privilege escalation technique. The access allows the device to function without relying on Meta's servers or its official apps.
The community is only in the early stages of exploring what root access could unlock on the Quest hardware. One possibility already identified is enabling a 90 Hz refresh rate — a capability that former Meta CTO John Carmack acknowledged in 2019 was deliberately capped at 72 Hz in the operating system for performance reasons. Separately, projects are underway to get VR controllers from other manufacturers working with the original Quest.
A precedent set with the Oculus Go
This isn't the first time Meta headset owners have been handed full access to their device's software. In 2021, Carmack released an official update granting "full root access" to the Oculus Go, the wireless predecessor to the Quest. At the time, he said he hoped the move would let tinkerers put the Go hardware to new uses immediately, and would also guarantee that a shrink-wrapped Go headset discovered decades later could still be updated to its final software version, even after Meta's over-the-air update servers had been shut down.
Could Quest 2 be next?
The author of the QuestStack project, who goes by starseed12345 on GitHub, has speculated that a similar exploit could likely unlock root access on Quest 2 units running older firmware. For now, though, that developer believes the risk of permanently bricking a device outweighs the benefits of unlocking its bootloader.
