Two Projects Now Unlock the Quest 1 Bootloader, and One of Them Runs in a Browser Tab

QuestStack roots an original Meta Quest and unlocks its bootloader, on the same firmware build the headset was left sitting on when Meta walked away from it. A developer working as starseed12345 put the project on GitHub at the end of July under the GPL, and pushed the released version on August 22.

The unlock chains two things together. First is GhostLock, a privilege escalation chain that gets root on the running system. Second is CVE-2021-1931, a buffer overflow in the way the ABL handles fastboot commands. ABL is the Android Bootloader, the Qualcomm stage that runs before Android does and decides whether everything after it is properly signed. Qualcomm disclosed the bug in July 2021. QuestStack takes root, swaps the stock ABL for a vulnerable build, and then walks through the hole it just installed.

Your headset has to be on build 49845030443200410, the last firmware Meta ever shipped for the Quest 1. Check yours with adb shell getprop ro.build.version.incremental.

On August 20 the process got considerably easier. darknight1050, whose earlier quest-bootloader-unlocker QuestStack credits, published a WebUSB reimplementation. WebUSB lets a page talk to plugged-in hardware directly, so the entire unlock now runs in a Chromium tab at quest1-unlock.skystate.ch. Nothing to install. The source is linked from the header of the page itself.

The sequence is the interesting part, so here it is. Your Quest 1 keeps two copies of the system, slot A and slot B, the same A/B arrangement Android phones use so an update can be written to the half you are not currently running. The tool fingerprints the headset and refuses anything that is not a supported Quest 1. It copies all 13 partitions it is about to overwrite into browser storage, then reads each one back off the device and re-hashes it, so a backup that did not really take cannot pass for one that did. Then it writes 2021 into the slot you are not using: build 16476800119700000, version 29.0.0.66, dated May 10 of that year. It points bootctl at that slot, reboots into fastboot, sends the overflow payload, and asks the bootloader for an unlock token. Then it puts your original slot back.

The care shows in one refusal. After the payload lands, the tool reads the lock state and reports it as tentative, because that answer is coming from a bootloader whose signature checking was patched out of memory seconds earlier. It reboots, reads again, and only the second answer decides whether the step succeeded. A device that claims unlocked while patched and locked after a clean boot gets described as exactly that, rather than as a green check. The same instinct runs through how it finds the active slot. It decodes the GPT partition attribute bits, where Qualcomm's boot control actually keeps that state, cross-checks them against the HAL, and says so when the two disagree instead of reporting a confident guess.

Now the costs. Unlocking wipes user data on the next boot, so move anything you care about off the headset first. QuestStack leaves the running slot unbootable when it finishes, which means sideloading a firmware update to get back to a working system. You need developer mode on, adb working, a Chromium browser over https, and on Windows both the ADB and fastboot interfaces bound to WinUSB. The firmware images are not distributed by Meta, so both projects point at a community mirror. That is not a link we are going to print.

Quest 1 only. Not Quest 2, not Quest Pro. QuestStack's README speculates that Quest 2 headsets on v59 or earlier stand a similar chance of working, then answers its own speculation: the odds of bricking outweigh the benefit.

The timing deserves a moment. Meta cut the Quest 1 off from Horizon and stopped adding features in March 2023, then ended security patches and bug fixes on August 31, 2024. This unlock works because a Qualcomm bug from 2021 is still sitting unfixed in a bootloader nobody maintains. The headset became fully ownable for the same reason it became unsafe.

Be clear about what this is not. An unlocked bootloader is not an operating system, and nobody has shipped an alternative one for the Quest 1. What changes is the floor. Unsigned system images become possible, custom kernels become possible, and so does the longer-term prospect of running something like Monado, the open-source OpenXR runtime, on hardware whose vendor stack has been frozen for two years.

It lands strangely against the other end of this beat. Four days ago the founder of Combat Waffle Studios described rooted headsets as the exact thing standalone anti-cheat exists to stop. He is right, and this is the same capability seen from the other side. The difference is who is still maintaining the device. A 2019 headset nobody patches is worth more with an open bootloader than it is in a drawer.