Ray-Ban Meta glasses checked app signatures, but a paired phone could turn the check off

The glasses started checking who signed their apps. The paired phone could still change whether that check happened. In a November 6 disclosure, researcher p0pcycle described running a self-signed application on Ray-Ban Meta smart glasses despite a newly introduced safeguard.

According to the write-up, relevant firmware through version 126 did not verify the developer-tool application's signature. Version 127 added verification, but accepted configuration data without checking for tampering. The demonstrated command access stayed within an application's privileges, rather than granting full administrative control.

This was a controlled test involving borrowed glasses and manipulation of their paired phone, not evidence that strangers can hijack arbitrary glasses over the internet. The broader lesson is a trust-boundary failure: verifying software provides little protection if another device can rewrite the verification rules. Hackaday subsequently covered the research.

The author says the findings went through Meta's bug-bounty program and that Meta approved publication. She inferred that the issues were fixed; the disclosure does not identify a final patched version. Owners should keep the glasses and companion app updated and avoid untrusted development tools or modified apps on the paired phone.

Source times: p0pcycle, November 7, 2026, 01:51:45 Beijing time / November 6, 2026, 12:51:45 PM EST; Hackaday, November 13, 2026, 11:00:45 Beijing time / November 12, 2026, 10:00:45 PM EST.