QuestStack bootloader gives original Meta Quest full root access
A new open-source project allows users to bypass Meta’s servers and sideload apps on the discontinued VR headset, potentially unlocking higher refresh rates.
The original Meta Quest headset, which the company officially discontinued in 2023, has been granted full root access through a new bootloader project called QuestStack. The initiative provides developers and enthusiasts with complete control over the hardware by integrating previously known vulnerabilities in the Android fastboot process into a privilege escalation chain.
This exploit allows users to bypass Meta’s servers and services entirely, meaning the device can function without relying on the company’s infrastructure. Consequently, owners can sideload applications without registering for a Meta Developer account or activating Developer Mode through Meta’s mobile app. The bootloading process is streamlined to be completed via a web interface after connecting the headset to a PC, requiring no additional downloads.
The independence from Meta’s servers also ensures that users can complete initial setup and login steps for a fresh headset even if Meta shuts down its support servers. This development is significant for the longevity of the device, which was launched in 2019 by Meta, then known as Oculus.
Tinkerers are currently in the early stages of investigating how root access can unlock previously unavailable features. One notable possibility is activating a 90 Hz refresh rate, which John Carmack admitted in 2019 was being held back to 72 Hz in the operating system for performance reasons. Projects are also underway to enable compatibility with other VR controllers.
The release of QuestStack echoes a 2021 move by Meta’s then-CTO John Carmack, who released an official full root access update for the Oculus Go, the Quest’s wireless predecessor. Carmack hoped the update would allow tinkerers to repurpose the hardware and ensure the device could update to its final software version long after over-the-air servers were shut down.
QuestStack author starseed12345 has speculated on GitHub that a similar exploit could enable root access on Quest 2 headsets running older firmware. However, the author notes that for those devices, the chance of bricking the hardware currently outweighs the benefit of unlocking the bootloader.