Root exploit for Meta Quest 3, adapted from IonStack (CVE-2026-43499) in CyberMeowfia.
| Item | Value |
|---|---|
| Device | Meta Quest 3 |
| Architecture | aarch64 |
| Kernel | Linux localhost 5.10.240-g69827d40d782 #1 SMP PREEMPT Mon Jun 1 13:01:51 PDT 2026 aarch64 Toybox |
| Incremental | 52168470043600520 |
| mm_struct | order-2 |
Kernels of similar versions are likely to work without re-adaptation.
Meta has fixed CVE-2026-43499 in Quest 3 incremental build 52345320040100520 and Quest 3s incremental build 3697600032300610. Devices running these builds or later are no longer vulnerable to this exploit.
If your kernel version matches the device info above, skip ionstack.conf.
If your firmware version differs, you can auto-generate the config via GitHub Actions:
-
Fork this repository.
-
Get your device's incremental number via adb:
adb shell getprop ro.build.version.incremental
-
Download the matching firmware. If you don't know the download URL, use the following (replace
{incremental}with the value from the previous step):Quest3
https://files.cocaine.trade/firmware/meta/Quest%203/q3_{incremental}.zipQuest3s
https://files.cocaine.trade/firmware/meta/Quest%203S/q3s_{incremental}.zip -
Run the Action: In your forked repo, run the
generate-ionstack-configworkflow, fill in the firmware download URL, wait for completion, and download the generatedionstack.conf.
Download the precompiled preload binary from the Releases page.
Requires Android NDK. The recommended version is:
https://dl.google.com/android/repository/android-ndk-r29-linux.zip
After installing the NDK, build from the project directory:
makePush files to the device and execute:
# Push preload
adb push preload /data/local/tmp/
# Push ionstack.conf if your incremental differs from 52168470043600520
# (skip this step if your device matches the default incremental above)
adb push ionstack.conf /data/local/tmp/
# Make executable and run
adb shell chmod +x /data/local/tmp/preload
adb shell /data/local/tmp/preload
# Optional. If you want to run commands like pm directly in root shell without root manager.
runcon u:r:shell:s0 /system/bin/shIf everything works, you should get a root shell.
- Do NOT modify any system partition, especially do not run any manager install commands. This can brick your device.
- Running the exploit may cause the Quest to hang. If this happens, long-press the power button to force reboot.
- The exploit has the highest success rate right after boot. A fresh reboot is recommended before running.
- CyberMeowfia — original IonStack (CVE-2026-43499) exploit
- @zhuowei/cheese — key adaptation info
- kernelsnitch — kernel module
- @ptrpaws/cocaine.trade — firmware links
