A new bootloader exploit for the original Meta Quest grants root access, allowing users to bypass Meta's restrictions and unlock features like 90 Hz refresh rate. Tinkerers are exploring further hardware modifications.
<p>Remember the original Quest headset that Meta (then Oculus) <a href="https://arstechnica.com/gaming/2019/04/oculus-quest-review-2019s-best-new-gaming-system-is-wireless-affordable-vr/">trumpeted back in 2019</a>? Meta seems to hope you don't, since the company <a href="https://arstechnica.com/gaming/2023/01/meta-ends-support-for-original-quest-headset-after-less-than-4-years/">officially stopped supporting the wireless VR headset</a> in 2023 to focus on <a href="https://arstechnica.com/gaming/2022/10/what-happened-to-the-virtual-reality-gaming-revolution/">the more popular Quests 2 and 3</a>. Luckily, tinkerers haven't similarly abandoned the hardware and recently released <a href="https://github.com/starseed12345/QuestStack">a new root-access exploit and bootloader</a> that gives "developers and enthusiasts full control over Quest 1 hardware."</p>
<p>The QuestStack project integrates <a href="https://github.com/darknight1050/quest-bootloader-unlocker">previously known vulnerabilities</a> in <a href="https://github.com/QuestEscape/research">the Quest's Android fastboot process</a> into a privilege escalation chain that leads easily to full root access on the device. The bootloading process is now streamlined enough that it can be completed without any downloads <a href="https://quest1-unlock.skystate.ch/">through a web interface</a> after connecting the headset to a PC.</p>
<p>With this exploit, the original Quest hardware can now be officially divorced from any reliance on Meta's servers or services to be useful. That means enterprising Quest owners should be able to sideload apps without needing to <a href="https://developers.meta.com/horizon/documentation/native/android/mobile-device-setup/">register for a Meta Developer account and activating Developer Mode through Meta's mobile app</a>. It also means users should be able to go through the initial setup and login steps for a fresh Quest headset even if and when Meta decides to shut down the servers that currently support this process.</p><p><a href="https://arstechnica.com/gaming/2026/08/new-bootloader-lets-you-take-the-meta-out-of-the-original-meta-quest/">Read full article</a></p>
<p><a href="https://arstechnica.com/gaming/2026/08/new-bootloader-lets-you-take-the-meta-out-of-the-original-meta-quest/#comments">Comments</a></p>
# New bootloader lets you take the "Meta" out of the original Meta Quest
Source: [https://arstechnica.com/gaming/2026/08/new-bootloader-lets-you-take-the-meta-out-of-the-original-meta-quest/](https://arstechnica.com/gaming/2026/08/new-bootloader-lets-you-take-the-meta-out-of-the-original-meta-quest/)
Privilege escalation attack grants “full control” and freedom from Meta’s servers/apps\.
Wipe off the dust and load up some new firmwareCredit: Sam Machkovech
Tinkerers are also in the early stages of figuring out how root access can unlock previously unavailable features on the Quest hardware\. That includes activating the 90 Hz refresh rate that[John Carmack admitted in 2019](https://www.engadget.com/2019-09-26-john-carmack-oculus-connect-cto-keynote.html)was being held back to 72 Hz in the OS for performance reasons\. There are also projects in the works to[get other VR controllers working with the original Quest](https://github.com/Juspertinry/q2ctrl-module)\.
In 2021, Meta’s then\-CTO John Carmack[released an official “full root access” update for the Oculus Go](https://arstechnica.com/gaming/2021/10/john-carmack-pushes-out-unlocked-os-for-defunct-oculus-go-headset/), the Quest’s wireless predecessor\. At the time,[Carmack said](https://x.com/ID_AA_Carmack/status/1441496416463904768)he hoped that update would allow tinkerers to “repurpose the \[Go\] hardware for more things today” and ensure that “a randomly discovered shrink wrapped \[Go\] headset twenty years from now \[would\] be able to update to the final software version, long after over\-the\-air update servers have been shut down\.”
QuestStack author starseed12345[speculates on GitHub](https://github.com/starseed12345/QuestStack)that a similar exploit could probably enable root access on Quest 2 headsets running older firmware versions but that currently “the chance of bricking outweighs the benefit of unlocking the bootloader\.”
[](https://arstechnica.com/author/kyle-orland/)
Kyle Orland has been the Senior Gaming Editor at Ars Technica since 2012, writing primarily about the business, tech, and culture behind video games\. He has journalism and computer science degrees from University of Maryland\. He once[wrote a whole book about*Minesweeper*](https://bossfightbooks.com/collections/books/products/minesweeper-by-kyle-orland)\.
[6 Comments](https://arstechnica.com/gaming/2026/08/new-bootloader-lets-you-take-the-meta-out-of-the-original-meta-quest/#comments)
1. [](https://arstechnica.com/security/2026/08/aliexpress-caught-fingerprinting-visitors-after-sending-inaudible-sounds-to-browsers/)
A detailed blog post about unlocking the bootloader and modding the Kyocera KY-42C feature phone, which was considered unrootable after a firmware update. The author investigates MediaTek boot process and exploits.
Meta has enabled ADB (Android Debug Bridge) access on its discontinued Portal smart display devices, giving users more control over the deprecated hardware.
This article details how researchers bypassed the firmware downgrade protection in the Tesla Wall Connector's bootloader, allowing installation of older firmware versions despite the security ratchet.
ps5-linux-loader is a Linux payload that exploits hypervisor vulnerabilities on PS5 Phat and Slim consoles (firmware 3.00-7.61) to run a custom bootloader, enabling full Linux desktop usage with GPU acceleration, USB, Bluetooth, and M.2 SSD support.
DFlash v0.1.4 releases custom Metal verify kernels for quantized Qwen3 hybrid models with significant peak memory reduction and 2.2x throughput improvements at long context on M5 Max GPUs.