# 0. Choosing a Unity Version for Quest 2 > [!important] This series targets Unity 6.3 LTS (6000.3.27f2) and newer > Unity 6000.4 and 6000.5 are not recommended: **Unity 6.5 reached end of life on 2026-08-31** and, like 6.4, has no patch for the October 2026 advisories. Notes 2-9 were retargeted to 6000.3.27f2+ on 2026-11-03. **Unity 6000.6.8f1 or later** is the other fully patched option, but it needs a `PanelRenderer` rewrite of the UI Toolkit panel in note 7. Facts were read from the linked pages on 2026-11-03; items I could not confirm are marked **(unverified)**. Part of [[Meta Quest 2]]. Next: [[1.Quest 2 Support Status]]. ## Short answer | Goal | Pick | Why | |---|---|---| | **Best fit for 5 sideloaded Quest 2 headsets** | **Unity 6.3 LTS, 6000.3.27f2 or newer** | Patched for all three advisories below. Supported until 2027-12-04, which lines up with Meta's Quest 2 security window (through Dec 2027). A forum report says Meta XR SDK builds work on 6000.3.* while 6000.4 and 6000.5 break. Meets the UI Toolkit world-space requirement (6.2+). | | Newest supported stream instead | **6000.6.8f1 or newer** (released 2026-11-03) | Newest supported stream and fully patched. Tradeoff: the series needs a `PanelRenderer` rewrite of the room panel, Meta SDK compatibility on 6.6 is **(unverified)**, and 6.6 will be superseded by the 6.7 LTS. | | Fallback if a package refuses 6.3 | 6000.0.85f2 or newer | Patched, but 6.0 LTS support ended 2026-10-16 (extended support to 2027-10-16) and it has no world-space UI Toolkit. | | **Avoid** | 6000.4.x, 6000.5.x | End of life, no listed patch for the October 2026 advisories, and reported Meta SDK build breakage. | | **Avoid** | 6000.0 before 6000.0.58f2, 6000.1 before 6000.1.17f1, 6000.2 before 6000.2.6f2 | Vulnerable to CVE-2025-59489 (the "last year" advisory). | There is no good "in-between" among the non-LTS streams: 6000.4 and 6000.5 are the in-between versions, and they are the ones that lost support without being patched. ## The advisories ### CVE-2025-59489 (Oct 2025, CVSS 8.4 High) Unity Runtime untrusted search path. On Android, another app on the same device can launch your exported `UnityPlayerActivity` with a crafted `unity` intent extra and get a native library of its choosing loaded into your app. It affects apps built with Unity 2017.1 and later on Android, Windows, macOS and Linux. First fixed editor builds: **6000.0.58f2, 6000.1.17f1, 6000.2.6f2, 6000.3.0b4** (also 2022.3.62f2 / 2022.3.67f2, 2021.3.45f2 / 2021.3.56f2). Any 6000.3 final, 6000.4, 6000.5 or 6000.6 build is not affected. Fix for already-built apps: rebuild with a patched editor, or run Unity's Unity Binary Patch tool on the APK. Unity states that on Horizon OS "Meta devices have implemented mitigations so that vulnerable Unity apps running on Horizon OS cannot be exploited." Nanome's write-up attributes the mitigation to Horizon OS v79 **(version number unverified on a Meta page)**. Source: [Unity security advisory CVE-2025-59489](https://unity.com/security/sept-2025-01) ### CVE-2026-111497 (Brotli decoder, disclosed 2026-10-21, CVSS 4.0 9.2) Buffer overflow in the Brotli decoder. Your app is exposed only if it decompresses attacker-controlled Brotli data through `BrotliStream`, `BrotliDecoder` or `HttpClient` with Brotli decompression. `UnityWebRequest` and AssetBundles do not use Brotli. The editor's Package Manager is also affected through a malicious or impersonated scoped registry. | Stream | Fixed in | |---|---| | 6000.7 beta | 6000.7.0b7 | | 6000.6 | **6000.6.8f1** | | 6000.3 LTS | **6000.3.27f2** | | 6000.0 LTS | **6000.0.85f2** | | 6000.1, 6000.2, 6000.4, 6000.5 | none listed (end of life) | | 2022.3, 2021.3 | "being assessed" | The 6000.6.8f1 and 6000.3.27f2 release notes both list the Brotli fix (IL2CPP and Mono), the Package Manager Node.js update, and "Reject TLS connections to servers using the compromised eMudhra certificates." Source: [Unity Brotli advisory](https://unity.com/security/unity-brotli-decoder-vulnerability), [6000.6.8f1 notes](https://unity.com/releases/editor/whats-new/6000.6.8f1), [6000.3.27f2 notes](https://unity.com/releases/editor/whats-new/6000.3.27f2) ### CVE-2026-114406 (eMudhra CA compromise, disclosed 2026-10-20) UnityTLS trusted certificates from a compromised certificate authority. Same fixed builds as the Brotli advisory. Unity says Android games are protected by Google's October 2026 Play Services update; **whether that protection reaches Horizon OS is unverified**, so rely on the patched editor if your app makes TLS connections. Unity also lists the `com.unity.xr.oculus` package as "update in progress" and the Android OpenJDK as waiting on an Adoptium update. The OpenXR plugin path used in this series does not use the Oculus package. Source: [Unity eMudhra advisory](https://unity.com/security/unity-emudhra-compromise) ## Does sideloading change the risk? Yes, mostly in your favor, but it does not remove the reason to patch. - **CVE-2025-59489** needs a hostile app installed on the same headset. With five headsets that only run apps you built or trust, the exposure is small. Meta's Horizon OS mitigation also covers it. Keep the headsets on the current Horizon OS and rebuild any older APKs with a patched editor anyway. - **Brotli** only matters if your code decodes Brotli from an untrusted source. A local, offline experience does not. - **eMudhra** only matters if the app does TLS to external servers. - **Editor side**: the Package Manager issue is a risk on your PC, not the headset. Do not add scoped registries you do not control, and update the editor. - **Quest 2 itself**: Horizon OS v2.13 is the last feature OS, with security fixes through Dec 2027 ([[1.Quest 2 Support Status]]). That makes a Unity stream supported through Dec 2027 (6.3 LTS) a natural match. ## Tradeoffs: 6.3 LTS vs 6.6 | | 6000.3.27f2+ (6.3 LTS) | 6000.6.8f1+ | |---|---|---| | Support | Until 2027-12-04 | Supported now; replaced by 6.7 LTS later | | All three advisories | Fixed | Fixed | | UI Toolkit world-space panels | Yes (6.2+) with XRI 3.2.0+ | Yes | | `PanelRenderer` component | No (6000.5+ only) | Yes | | Meta Quest build profile and platform browser | Yes (6.1+; Meta packages installable from the browser in 6.3+) | Yes | | Meta XR SDK build reports | Forum user reports it works on 6000.3.* | **Unverified** for SDK 207 on 6.6 | | Default Target API (Meta Quest profile) | API 32 | Check in the profile (unverified for 6.6) | This series is written for 6000.3, so [[7.Quest 2 Worked Example Room]] and [[8.UI Toolkit for VR]] use `UIDocument` with a World Space Panel Settings asset and no `PanelRenderer`. Unity's 6000.3 docs describe World Space panels; the `UIDocument` example was not compiled on 6000.3 **(unverified)**. ## Does the SDK stack in these notes still work? - **Meta's minimum** is Unity 6000.0.66f2 with Android Build Support, OpenJDK and Android SDK/NDK ([Meta requirements](https://developers.meta.com/vr/documentation/unity/unity-development-requirements/)). Both recommended streams are above that. - **OpenXR path** (Unity OpenXR Plugin + Unity OpenXR: Meta + XRI + XR Hands, as in [[2.Quest 2 SDK Stack]]): Unity documents the same two packages on 6000.3 and 6000.6 ([6000.3 page](https://docs.unity3d.com/6000.3/Documentation/Manual/xr-meta-quest-packages.html)). The notes pin the versions Unity lists for 6000.3 (table below); use XRI 3.4.0 or newer for world-space UI. - **Meta XR SDK path** (scripts that use `OVRManager` or the Core SDK): a forum thread reports All-in-One SDK 203.0.0 failing on 6000.5.0f1 (CS0619 `GetInstanceID` / `EntityId`) and on 6000.4.11f1 (Gradle error: namespace `com.oculus.Integration` used in multiple modules), with a user saying it works on 6000.3.* ([thread](https://discussions.unity.com/t/meta-xr-sdk-wont-build-on-unity-6-5-cs0619-getinstanceid-entityid-or-6000-4-x-com-oculus-integration-namespace-conflict/1723554)). Meta's Interaction SDK 207.0 release notes say "Fixed compilation errors on Unity 6.3 and later by gating the use of GetInstanceID" ([Meta ISDK](https://developers.meta.com/horizon/downloads/package/meta-xr-interaction-sdk/)). Core SDK 207.0 mentions a toolbar option in Unity 6000.3+ ([Meta Core SDK](https://developers.meta.com/vr/downloads/package/meta-xr-core-sdk/)). Whether 207 fully clears the 6000.5 / 6.6 errors is **unverified**; update all Meta packages together and test a blank-scene build first. - **Quest 2 limit**: Meta VR OS SDK v213 is the last SDK that supports Quest 2. If a newer Meta package drops Quest 2, pin to the last version that supports it. - **Target API**: the Meta Quest build profile defaults to Target API 32 in 6000.3 ([Unity docs](https://docs.unity3d.com/6000.3/Documentation/Manual/xr-meta-quest-build-profile.html)). Meta's store upload tool rejects targets above 34. For sideloading, API 34 is a safe choice; whether Horizon OS blocks a lower sideloaded target is **(unverified)**. ## Support status (as of 2026-11-03) | Stream | Status | Latest seen | |---|---|---| | 6.6 | Supported | 6000.6.8f1 (2026-11-03) | | 6.5 | Ended 2026-08-31 | 6000.5.11f1 | | 6.4 | Ended 2026-06-17 | 6000.4.12f1 | | 6.3 LTS | Until 2027-12-04 | 6000.3.27f2 (2026-10-30) | | 6.0 LTS | Ended 2026-10-16, extended to 2027-10-16 | 6000.0.85f1 | Dates from [endoflife.date/unity](https://endoflife.date/unity) and [Unity's support page](https://unity.com/releases/unity-6/support), which itself confirms 6.3 LTS until December 2027 and 6.0 LTS through October 2026. Unity's 6.5 announcement thread is marked end of life ([post](https://discussions.unity.com/t/unity-6-5-is-now-available/1723176)). ## Known issues on the recommended builds - 6000.3.27f2 and 6000.6.8f1 both list: Android back gesture/button closes the app after returning from background when "Run In Background" and "Predictive Back Support" are on (UUM-159613). Leave Predictive Back off for Quest builds. - 6000.3.27f2 also lists a Shader System hang when repeatedly calling `SceneManager.LoadSceneAsync` (UUM-156125), which 6000.6.8f1 lists too. Avoid rapid scene switching in tests. ## Checklist 1. Install **6000.3.27f2+** (or **6000.6.8f1+**) with Android Build Support, OpenJDK, and Android SDK & NDK through Unity Hub. 2. Create the project, add the Meta Quest build profile, and let Package Manager choose verified OpenXR / XRI versions. 3. Build a blank scene to a headset with [[4.Quest 2 Testing and Deployment]] before writing any code. 4. Rebuild any APK made before the patched builds, and keep headsets on the current Horizon OS. ## Setup differences vs 6000.5 Notes 2-7 were first written against the Unity 6000.5 docs and have now been retargeted to **6000.3 LTS**. This section records what differs from 6000.5 (and, for UI, from 6000.6). "Same" means I compared the 6000.3 and 6000.5 docs and found no difference. ### Build Profiles vs Build Settings **Same.** The Build Profiles window and the **Meta Quest** platform/profile exist from Unity 6.1 onward, so 6000.3 uses the same **File > Build Profiles > Meta Quest** flow as note 3 ([6000.3 page](https://docs.unity3d.com/6000.3/Documentation/Manual/xr-meta-quest-build-profile.html)). Defaults on 6000.3: Vulkan, minimum API 29, **target API 32**, IL2CPP, ARM64, Stereo Instancing. The 6000.3 page is named `xr-meta-quest-build-profile.html`; the 6000.5 notes link to `...-build-profile-settings.html`, so fix those links when you work on 6000.3. New in 6.3: the platform browser can install Meta packages when you add the profile. ### Package versions (Unity "released for" label, 2026-11-03) | Package | 6000.3 | 6000.5 | Note | |---|---|---|---| | OpenXR Plugin | **1.16.1** (1.17.0-1.19.0 also listed as released) | 1.17.1 (1.18.0, 1.19.0 listed) | Application SpaceWarp needs OpenXR 1.11+, so either works | | Unity OpenXR: Meta | **2.7.0** | 2.5.1 (2.6.1, 2.7.0 listed) | 6000.3 page lists 2.7.0 as the released version; 6000.5 lists 2.5.1 as released but offers 2.7.0 | | XR Interaction Toolkit | **3.3.2** (3.4.0-3.7.0 also listed as released) | 3.5.1 (3.6.x released) | Install **3.4.0 or newer** for the UI Toolkit ray support note 7 needs | | XR Hands | **1.7.3** (1.8.1, 1.9.0, 1.10.0 listed) | 1.8.1 (1.9.0 listed) | Install 1.8.1+ if a hand feature in note 6 is missing | | Meta XR SDK | Core/ISDK **207.0**; minimum editor 6000.0.66f2 | same | ISDK 207 fixes compile errors on Unity 6.3+; fine on 6000.3 | Sources: [OpenXR 6000.3](https://docs.unity.com/en-us/engine/6000.3/manual/packages-list/packages-all/pack-safe/com-unity-xr-openxr), [OpenXR Meta 6000.3](https://docs.unity3d.com/6000.3/Documentation/Manual/com.unity.xr.meta-openxr.html), [XRI 6000.3](https://docs.unity.com/en-us/engine/6000.3/manual/packages-list/packages-all/pack-safe/com-unity-xr-interaction-toolkit), [XR Hands 6000.3](https://docs.unity.com/en-us/engine/6000.3/manual/packages-list/packages-all/pack-safe/com-unity-xr-hands), [OpenXR 6000.5](https://docs.unity3d.com/6000.5/Documentation/Manual/com.unity.xr.openxr.html), [OpenXR Meta 6000.5](https://docs.unity3d.com/6000.5/Documentation/Manual/com.unity.xr.meta-openxr.html). Pick the "released" version Package Manager shows first, then upgrade XRI deliberately. ### Android API, Gradle and JDK - **Target API:** 6000.3 can target API 35 and 36; Meta's Quest profile default is still 32. Keep the note 3 step that sets **34** (Meta's store upload tool rejects targets above 34). For sideloading, a lower target also installs; I did not verify that Horizon OS never blocks it. - **Minimum API:** 6000.3 supports Android 7.1 (API 25) and up; 6000.5 supports 8.0 (API 26) and up. The Quest profile default of 29 is the same either way. - **JDK and NDK:** **same.** JDK 17 and NDK r27c for all of 6000.0+. SDK build tools 36.0.0 in both; the bundled SDK command-line tools are 16 in 6000.3.0-6000.3.25, 16 in 6000.3.26-27, and 21 from 6000.3.28f1 ([Unity table](https://docs.unity3d.com/6000.3/Documentation/Manual/android-supported-dependency-versions.html)). Leave "Installed with Unity (recommended)" on for JDK/SDK/NDK/Gradle. - **Gradle:** the exact bundled Gradle version for each editor is **unverified** (the docs I read do not state it). Use the one installed with Unity. ### URP and Render Graph - 6000.3 (URP 17.3): Render Graph is on by default for all projects. Compatibility Mode exists only behind the `URP_COMPATIBILITY_MODE` scripting define. A new project from the Universal 3D template needs nothing, so note 3 §3.4 ("Render Graph on, compatibility mode off") and note 5's Application SpaceWarp requirements still hold ([Unity forum post](https://discussions.unity.com/t/render-graph-updates-in-unity-6-3/1668122)). - 6000.4 and later: Compatibility Mode and the define are removed ([6.4 upgrade guide](https://docs.unity.com/en-us/engine/6000.6/manual/upgrade-guides/upgrade-guide-unity64)). Custom `ScriptableRenderPass` code must implement `RecordRenderGraph`. The notes' scripts do not define custom render passes, so nothing to change. - URP 17.3 on 6000.3 satisfies the "URP 17.0.3+" Application SpaceWarp requirement. The doc link in note 5 now points to the 6000.2 copy of the page (`xr-graphics-spacewarp.html`); the 6000.3 URL on docs.unity3d.com returned an error when I checked. ### UI Toolkit world-space panels - **6000.3: available.** Set the Panel Settings asset's **Render Mode = World Space** ([World Space UI, 6000.3](https://docs.unity.com/en-us/engine/6000.3/manual/uitoolkits/uielements/uie-support-for-runtime-ui/world-space-ui)). The panel gets a collider (Collider Update Mode options exist). Use the **UI Document** component, as note 7 does. XRI needs 3.2.0+ for world-space UI Toolkit and 3.4.0+ for `XRRayInteractor` support. - **6000.5 and later:** a **Panel Renderer** component (Component > UI Toolkit > Panel Renderer) takes a Panel Settings asset, a Source Asset (UXML) and world-space dimensions. The 6000.6 docs say **UI Document is obsolete and superseded by Panel Renderer, and you cannot add UI Document to new GameObjects in the Editor** (existing ones keep working) ([UI Document, 6000.6](https://docs.unity.cn/6000.6/Documentation/Manual/UIE-create-ui-document-component.html), [Panel Renderer, 6000.7](https://docs.unity.com/en-us/engine/6000.7/manual/uitoolkits/uielements/uie-support-for-runtime-ui/uie-render-runtime-ui/panel-renderer-component)). So **note 7 step 2 and `RoomControlPanel` (which uses `[RequireComponent(typeof(UIDocument))]`) will not work as written on 6000.6**. I have not rewritten it for `PanelRenderer`, and whether 6000.5 already blocks adding UI Document is **unverified**. - **Fallback if a world-space panel misbehaves on either version:** render the UI Toolkit panel to a RenderTexture shown on a quad (unverified whether [[8.UI Toolkit for VR]] covers this exact setup) and drive it with ray input yourself. ### What changed in notes 2-7 for 6000.3 | Note | Step | Change made | |---|---|---| | [[2.Quest 2 SDK Stack]] | 2.2 version table | Use the 6000.3 column above. | | [[3.Quest 2 Project and Build Setup]] | 3.1 step 1 | Install 6000.3.27f2 or newer instead of 6000.5. | | | 3.1 step 3 | Same flow; link to the 6000.3 build-profile page name. | | | 3.2 | Install XRI **3.4.0+** (default is 3.3.2) and XR Hands 1.8.1+ if needed. | | | 3.3 | Feature names are the same; the Meta Quest Support doc link points to `@2.5`, so use `@2.7`. | | | 3.4 | Same; Render Graph is on by default. | | [[4.Quest 2 Testing and Deployment]] | all | Doc link re-pointed to 6000.3. | | [[5.Quest 2 Performance and Rendering]] | SpaceWarp, foveation | Same requirements; doc links re-pointed (Spacewarp link is the 6000.2 copy). | | [[6.Quest 2 Input Hands and Passthrough]] | hands | XR Hands 1.7.3 may be missing a feature; use 1.8.1+. Quest 2 limits are unchanged. | | [[7.Quest 2 Worked Example Room]] | UI panel | **No change on 6000.3**, since it uses UI Document and World Space render mode. **Needs a `PanelRenderer` rewrite on 6000.6.** XRI must be 3.4+. | None of these were compiled or run in an editor; treat the first headset build as the test.