{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,8]],"date-time":"2026-06-08T23:31:20Z","timestamp":1780961480261,"version":"3.54.1"},"publisher-location":"New York, NY, USA","reference-count":113,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,11,19]]},"DOI":"10.1145\/3719027.3765102","type":"proceedings-article","created":{"date-parts":[[2025,11,22]],"date-time":"2025-11-22T23:32:38Z","timestamp":1763854358000},"page":"4289-4303","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["<i>Virtual<\/i>\n                    Reality,\n                    <i>Real<\/i>\n                    Problems: A Longitudinal Security Analysis of VR Firmware"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-0482-6010","authenticated-orcid":false,"given":"Vamsi Shankar","family":"Simhadri","sequence":"first","affiliation":[{"name":"Department of Computer Science, George Mason University, Fairfax, VA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-2680-0302","authenticated-orcid":false,"given":"Yichang","family":"Xiong","sequence":"additional","affiliation":[{"name":"Department of Computer Science, George Mason University, Fairfax, VA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3582-5999","authenticated-orcid":false,"given":"Habiba","family":"Farrukh","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of California, Irvine, Irvine, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4646-7146","authenticated-orcid":false,"given":"Xiaokuan","family":"Zhang","sequence":"additional","affiliation":[{"name":"Department of Computer Science, George Mason University, Fairfax, VA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,11,22]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"''Hardening (computing) - Wikipedia -- en.wikipedia.org '' https:\/\/en.wikipedia.org\/wiki\/Hardening_(computing)."},{"key":"e_1_3_2_1_2_1","unstructured":"''Htc community forum '' https:\/\/forum.htc.com\/."},{"key":"e_1_3_2_1_3_1","unstructured":"''Ikconfig - linux kernel configuration database (lkddb) '' https:\/\/cateee.net\/lkddb\/web-lkddb\/IKCONFIG.html."},{"key":"e_1_3_2_1_4_1","volume-title":"Harvesting inconsistent security configurations in custom android {ROMs} via differential analysis,'' in USENIX Security","author":"Aafer Y.","year":"2016","unstructured":"Y. Aafer, X. Zhang, and W. Du, ''Harvesting inconsistent security configurations in custom android {ROMs} via differential analysis,'' in USENIX Security, 2016."},{"key":"e_1_3_2_1_5_1","first-page":"564","volume-title":"Vr-spy: A side-channel attack on virtual key-logging in vr headsets,'' in IEEE VR. hskip 1em plus 0.5em minus 0.4emrelax IEEE","author":"Arafat A. Al","year":"2021","unstructured":"A. Al Arafat, Z. Guo, and A. Awad, ''Vr-spy: A side-channel attack on virtual key-logging in vr headsets,'' in IEEE VR. hskip 1em plus 0.5em minus 0.4emrelax IEEE, 2021, pp. 564-572."},{"key":"e_1_3_2_1_6_1","volume-title":"Brotli compressed data format,'' RFC 7932. [Online]. Available: https:\/\/www.rfc-editor","author":"Alakuijala Tinterwordspacing J.","unstructured":"BIBentryALTinterwordspacing J. Alakuijala and Z. Szabadka, ''Brotli compressed data format,'' RFC 7932. [Online]. Available: https:\/\/www.rfc-editor.org\/info\/rfc7932 BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_7_1","unstructured":"Android Developers ''Permissions on android '' https:\/\/developer.android.com\/guide\/topics\/permissions\/overview."},{"key":"e_1_3_2_1_8_1","volume-title":"Use of native code","author":"Tinterwordspacing","year":"2025","unstructured":"BIBentryALTinterwordspacing ---, ''Use of native code,'' 2025. [Online]. Available: https:\/\/developer.android.com\/privacy-and-security\/risks\/use-of-native-code BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_9_1","volume-title":"Architecture overview","author":"Open Source Project Tinterwordspacing Android","year":"2025","unstructured":"BIBentryALTinterwordspacing Android Open Source Project, ''Architecture overview,'' 2025. [Online]. Available: https:\/\/source.android.com\/docs\/core\/architecture BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_10_1","volume-title":"Compatibility definition document","author":"Tinterwordspacing","year":"2025","unstructured":"BIBentryALTinterwordspacing ---, ''Compatibility definition document,'' 2025. [Online]. Available: https:\/\/source.android.com\/docs\/compatibility\/cdd BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_11_1","unstructured":"Apple ''Introducing apple vision pro '' https:\/\/www.apple.com\/apple-vision-pro\/."},{"key":"e_1_3_2_1_12_1","volume-title":"Consumer and enterprise virtual reality (vr) market revenue worldwide from 2021 to 2026 (in billion u.s. dollars)","author":"Insider Tinterwordspacing AR","year":"2022","unstructured":"BIBentryALTinterwordspacing AR Insider, ''Consumer and enterprise virtual reality (vr) market revenue worldwide from 2021 to 2026 (in billion u.s. dollars),'' 2022. [Online]. Available: https:\/\/www.statista.com\/statistics\/1221522\/virtual-reality-market-size-worldwide\/ BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_13_1","volume-title":"Pico os software","author":"Archive Tinterwordspacing I.","year":"2025","unstructured":"BIBentryALTinterwordspacing I. Archive, ''Pico os software,'' 2025. [Online]. Available: https:\/\/web.archive.org\/web\/20250000000000*\/https:\/\/www.picoxr.com\/global\/software\/pico-os BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_14_1","first-page":"217","volume-title":"Exploring the uncoordinated privacy protections of eye tracking and vr motion data for unauthorized user identification,'' in IEEE VR. hskip 1em plus 0.5em minus 0.4emrelax IEEE","author":"Aziz S.","year":"2025","unstructured":"S. Aziz and O. Komogortsev, ''Exploring the uncoordinated privacy protections of eye tracking and vr motion data for unauthorized user identification,'' in IEEE VR. hskip 1em plus 0.5em minus 0.4emrelax IEEE, 2025, pp. 217-227."},{"key":"e_1_3_2_1_15_1","volume-title":"Reliable third-party library detection in android and its security applications,'' in CCS","author":"Backes M.","year":"2016","unstructured":"M. Backes, S. Bugiel, and E. Derr, ''Reliable third-party library detection in android and its security applications,'' in CCS, 2016."},{"key":"e_1_3_2_1_16_1","volume-title":"Exploring user reactions and mental models towards perceptual manipulation attacks in mixed reality,'' in USENIX Security","author":"Cheng K.","year":"2023","unstructured":"K. Cheng, J. F. Tian, T. Kohno, and F. Roesner, ''Exploring user reactions and mental models towards perceptual manipulation attacks in mixed reality,'' in USENIX Security, 2023."},{"key":"e_1_3_2_1_17_1","volume-title":"Valve index headset technical specifications","author":"BIBentryALTinterwordspacing V. Corporation","year":"2019","unstructured":"BIBentryALTinterwordspacing V. Corporation, ''Valve index headset technical specifications,'' 2019. [Online]. Available: https:\/\/www.valvesoftware.com\/en\/index\/headset BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_18_1","volume-title":"Quarterly,'' https:\/\/www.counterpointresearch.com\/insight\/global-xr-ar-vr-headsets-market-share-quarterly","author":"Research Counterpoint","year":"2025","unstructured":"Counterpoint Research, ''Global XR (AR & VR Headsets) Market Share: Quarterly,'' https:\/\/www.counterpointresearch.com\/insight\/global-xr-ar-vr-headsets-market-share-quarterly, 2025."},{"key":"e_1_3_2_1_19_1","unstructured":"CVE ''Cve '' https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2018-9568."},{"key":"e_1_3_2_1_20_1","first-page":"555","article-title":"The performance cost of shadow stacks and stack canaries","author":"Dang T. H.","year":"2015","unstructured":"T. H. Dang, P. Maniatis, and D. Wagner, ''The performance cost of shadow stacks and stack canaries,'' in AsiaCCS, 2015, pp. 555-566.","journal-title":"AsiaCCS"},{"key":"e_1_3_2_1_21_1","unstructured":"N. V. Database ''CVE-2018-9525 Detail '' https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-9525 2018."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134059"},{"key":"e_1_3_2_1_23_1","volume-title":"Androguard: Reverse engineering, malware and goodware analysis of android applications,'' https:\/\/github.com\/androguard\/androguard","author":"A. Desnos","year":"2011","unstructured":"A. Desnos et al., ''Androguard: Reverse engineering, malware and goodware analysis of android applications,'' https:\/\/github.com\/androguard\/androguard, 2011-2024."},{"key":"e_1_3_2_1_24_1","unstructured":"X. Developers ''Xda developers forums '' https:\/\/xdaforums.com\/."},{"key":"e_1_3_2_1_25_1","volume-title":"On the (in)security of non-resettable device identifiers in custom android systems,'' arXiv preprint arXiv:2502.15270","author":"Dong Z.","year":"2025","unstructured":"Z. Dong, L. Wang, G. Xu, and H. Wang, ''On the (in)security of non-resettable device identifiers in custom android systems,'' arXiv preprint arXiv:2502.15270, 2025."},{"key":"e_1_3_2_1_26_1","first-page":"1","volume-title":"Languages and Programming. hskip 1em plus 0.5em minus 0.4emrelax Berlin","author":"Dwork Tinterwordspacing C.","year":"2006","unstructured":"BIBentryALTinterwordspacing C. Dwork, ''Differential Privacy,'' in Automata, Languages and Programming. hskip 1em plus 0.5em minus 0.4emrelax Berlin, Heidelberg: Springer Berlin Heidelberg, 2006, vol. 4052, pp. 1-12, series Title: Lecture Notes in Computer Science. [Online]. Available: http:\/\/link.springer.com\/10.1007\/11787006_1 BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_27_1","first-page":"1","volume-title":"BIBforeignlanguageenDifferential Privacy: A Survey of Results,'' in BIBforeignlanguageenTheory and Applications of Models of Computation. hskip 1em plus 0.5em minus 0.4emrelax Berlin","author":"Tinterwordspacing","year":"2008","unstructured":"BIBentryALTinterwordspacing ---, ''BIBforeignlanguageenDifferential Privacy: A Survey of Results,'' in BIBforeignlanguageenTheory and Applications of Models of Computation. hskip 1em plus 0.5em minus 0.4emrelax Berlin, Heidelberg: Springer Berlin Heidelberg, 2008, vol. 4978, pp. 1-19, series Title: Lecture Notes in Computer Science. [Online]. Available: http:\/\/link.springer.com\/10.1007\/978-3-540-79228-4_1 BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_28_1","volume-title":"Dissecting residual apis in custom android roms,'' in CCS","author":"El-Rewini Z.","year":"2021","unstructured":"Z. El-Rewini and Y. Aafer, ''Dissecting residual apis in custom android roms,'' in CCS, 2021."},{"key":"e_1_3_2_1_29_1","volume-title":"Samsung Gear VR Operating Instructions","author":"Electronics Tinterwordspacing S.","year":"2015","unstructured":"BIBentryALTinterwordspacing S. Electronics, Samsung Gear VR Operating Instructions, 2015. [Online]. Available: https:\/\/www.bhphotovideo.com\/lit_files\/132118.pdf BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_30_1","volume-title":"Sausage: security analysis of unix domain socket usage in android,'' in (EuroS&P). hskip 1em plus 0.5em minus 0.4emrelax IEEE","author":"Elgharabawy M.","year":"2022","unstructured":"M. Elgharabawy, B. Kojusner, M. Mannan, K. R. Butler, B. Williams, and A. Youssef, ''Sausage: security analysis of unix domain socket usage in android,'' in (EuroS&P). hskip 1em plus 0.5em minus 0.4emrelax IEEE, 2022."},{"key":"e_1_3_2_1_31_1","unstructured":"ellie ''Vr firmware download - quest series '' https:\/\/cocaine.trade\/."},{"key":"e_1_3_2_1_32_1","volume-title":"{FIRMSCOPE}: Automatic uncovering of {Privilege-Escalation} vulnerabilities in {Pre-Installed} apps in android firmware,'' in USENIX Security","author":"Elsabagh M.","year":"2020","unstructured":"M. Elsabagh, R. Johnson, A. Stavrou, C. Zuo, Q. Zhao, and Z. Lin, ''{FIRMSCOPE}: Automatic uncovering of {Privilege-Escalation} vulnerabilities in {Pre-Installed} apps in android firmware,'' in USENIX Security, 2020."},{"key":"e_1_3_2_1_33_1","volume-title":"An analysis of pre-installed android software,'' in S&P (Oakland). hskip 1em plus 0.5em minus 0.4emrelax IEEE","author":"Gamba J.","year":"2020","unstructured":"J. Gamba, M. Rashed, A. Razaghpanah, J. Tapiador, and N. Vallina-Rodriguez, ''An analysis of pre-installed android software,'' in S&P (Oakland). hskip 1em plus 0.5em minus 0.4emrelax IEEE, 2020."},{"key":"e_1_3_2_1_34_1","unstructured":"gameishard ''Virtual reality use increases concerns for child safety study shows '' https:\/\/gameishard.gg\/news\/over-75-believe-kids-at-major-risk-of-sexual-abuse-when-using-vr-headsets-report\/92677\/."},{"key":"e_1_3_2_1_35_1","unstructured":"E. Games ''Unreal engine forums '' https:\/\/forums.unrealengine.com\/."},{"key":"e_1_3_2_1_36_1","unstructured":"Github ''Boot-img-extractor '' https:\/\/github.com\/cfig\/Android_boot_image_editor."},{"key":"e_1_3_2_1_37_1","unstructured":"--- ''Extract-ikconfig '' https:\/\/github.com\/torvalds\/linux\/blob\/master\/scripts\/extract-ikconfig."},{"key":"e_1_3_2_1_38_1","unstructured":"--- ''Github '' https:\/\/github.com\/QuestEscape\/exploit\/tree\/master\/CVE-2018-9568_WrongZone."},{"key":"e_1_3_2_1_39_1","unstructured":"Google ''Android security bulletins '' https:\/\/source.android.com\/docs\/security\/bulletin\/asb-overview."},{"key":"e_1_3_2_1_40_1","volume-title":"Specifications for viewer design - cardboard manufacturer help","author":"Tinterwordspacing","year":"2015","unstructured":"BIBentryALTinterwordspacing ---, ''Specifications for viewer design - cardboard manufacturer help,'' 2015. [Online]. Available: https:\/\/support.google.com\/cardboard\/manufacturers\/answer\/6323398?hl=en BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_41_1","volume-title":"Hardening the kernel in android oreo,'' https:\/\/android-developers.googleblog.com\/2017\/08\/hardening-kernel-in-android-oreo.html","author":"Tinterwordspacing","year":"2017","unstructured":"---, ''Hardening the kernel in android oreo,'' https:\/\/android-developers.googleblog.com\/2017\/08\/hardening-kernel-in-android-oreo.html, 2017."},{"key":"e_1_3_2_1_42_1","volume-title":"Android xr: The gemini era comes to headsets and glasses","author":"Tinterwordspacing","year":"2025","unstructured":"BIBentryALTinterwordspacing ---, ''Android xr: The gemini era comes to headsets and glasses,'' 2025. [Online]. Available: https:\/\/blog.google\/products\/android\/android-xr\/ BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_43_1","volume-title":"The compatibility test suite (cts) overview,'' https:\/\/source.android.com\/docs\/compatibility\/cts","author":"Tinterwordspacing","year":"2025","unstructured":"---, ''The compatibility test suite (cts) overview,'' https:\/\/source.android.com\/docs\/compatibility\/cts, 2025."},{"key":"e_1_3_2_1_44_1","first-page":"859","article-title":"Hidden reality: caution, your hand gesture inputs in the immersive virtual world are visible to all!","author":"Gopal S. R. K.","year":"2023","unstructured":"S. R. K. Gopal, D. Shukla, J. D. Wheelock, and N. Saxena, ''Hidden reality: caution, your hand gesture inputs in the immersive virtual world are visible to all!'' in USENIX Security, 2023, pp. 859-876.","journal-title":"USENIX Security"},{"key":"e_1_3_2_1_45_1","first-page":"1","article-title":"empirical study on oculus virtual reality applications: Security and privacy perspectives","author":"Guo H.","year":"2024","unstructured":"H. Guo, H.-N. Dai, X. Luo, Z. Zheng, G. Xu, and F. He, ''An empirical study on oculus virtual reality applications: Security and privacy perspectives,'' in ICSE, 2024, pp. 1-13.","journal-title":"ICSE"},{"key":"e_1_3_2_1_46_1","volume-title":"{BigMAC}:{Fine-Grained} policy analysis of android firmware,'' in USENIX Security","author":"Hernandez G.","year":"2020","unstructured":"G. Hernandez, D. J. Tian, A. S. Yadav, B. J. Williams, and K. R. Butler, ''{BigMAC}:{Fine-Grained} policy analysis of android firmware,'' in USENIX Security, 2020."},{"key":"e_1_3_2_1_47_1","volume-title":"Large-scale security measurements on the android firmware ecosystem,'' in ICSE","author":"Hou Q.","year":"2022","unstructured":"Q. Hou, W. Diao, Y. Wang, X. Liu, S. Liu, L. Ying, S. Guo, Y. Li, M. Nie, and H. Duan, ''Large-scale security measurements on the android firmware ecosystem,'' in ICSE, 2022."},{"key":"e_1_3_2_1_48_1","volume-title":"Nie et al., ''Can we trust the phone vendors? comprehensive security measurements on the android firmware ecosystem,'' TSE","author":"Hou Q.","year":"2023","unstructured":"Q. Hou, W. Diao, Y. Wang, C. Mao, L. Ying, S. Liu, X. Liu, Y. Li, S. Guo, M. Nie et al., ''Can we trust the phone vendors? comprehensive security measurements on the android firmware ecosystem,'' TSE, 2023."},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"crossref","unstructured":"S. Ishaque A. Rueda B. Nguyen N. Khan and S. Krishnan ''Physiological signal analysis and classification of stress from virtual reality video game '' in 2020 42nd Annual International Conference of the IEEE Engineering in Medicine & Biology Society (EMBC). hskip 1em plus 0.5em minus 0.4emrelax IEEE 2020 pp. 867-870.","DOI":"10.1109\/EMBC44109.2020.9176110"},{"key":"e_1_3_2_1_50_1","volume-title":"Behavr: User identification based on vr sensor data,'' arXiv preprint arXiv:2308.07304","author":"Jarin I.","year":"2023","unstructured":"I. Jarin, Y. Duan, R. Trimananda, H. Cui, S. Elmalaki, and A. Markopoulou, ''Behavr: User identification based on vr sensor data,'' arXiv preprint arXiv:2308.07304, 2023."},{"key":"e_1_3_2_1_51_1","unstructured":"JDSUPRA ''A brave new world: How to manage safety hazards from augmented reality (ar) virtual reality (vr) and artificial intelligence (ai) '' https:\/\/www.jdsupra.com\/legalnews\/a-brave-new-world-how-to-manage-safety-3563947\/."},{"key":"e_1_3_2_1_52_1","volume-title":"{DEFInit}: An analysis of exposed android init routines,'' in USENIX Security","author":"Ji Y.","year":"2021","unstructured":"Y. Ji, M. Elsabagh, R. Johnson, and A. Stavrou, ''{DEFInit}: An analysis of exposed android init routines,'' in USENIX Security, 2021."},{"key":"e_1_3_2_1_53_1","volume-title":"Dependency facade: The coupling and conflicts between android framework and its customization,'' in ICSE. hskip 1em plus 0.5em minus 0.4emrelax IEEE","author":"Jin W.","year":"2023","unstructured":"W. Jin, Y. Dai, J. Zheng, Y. Qu, M. Fan, Z. Huang, D. Huang, and T. Liu, ''Dependency facade: The coupling and conflicts between android framework and its customization,'' in ICSE. hskip 1em plus 0.5em minus 0.4emrelax IEEE, 2023."},{"key":"e_1_3_2_1_54_1","unstructured":"Kaspersky ''What are the security and privacy risks of vr and ar '' https:\/\/usa.kaspersky.com\/resource-center\/threats\/security-and-privacy-risks-of-ar-and-vr."},{"key":"e_1_3_2_1_55_1","volume-title":"Passwalk: Spatial authentication leveraging lateral shift and gaze on mobile headsets,'' in ACM Multimedia","author":"Kumar A.","year":"2022","unstructured":"A. Kumar, L.-H. Lee, J. Chauhan, X. Su, M. A. Hoque, S. Pirttikangas, S. Tarkoma, and P. Hui, ''Passwalk: Spatial authentication leveraging lateral shift and gaze on mobile headsets,'' in ACM Multimedia, 2022."},{"key":"e_1_3_2_1_56_1","volume-title":"{PolyScope}:{Multi-Policy} access control analysis to compute authorized attack operations in android systems,'' in USENIX Security","author":"Lee Y.-T.","year":"2021","unstructured":"Y.-T. Lee, W. Enck, H. Chen, H. Vijayakumar, N. Li, Z. Qian, D. Wang, G. Petracca, and T. Jaeger, ''{PolyScope}:{Multi-Policy} access control analysis to compute authorized attack operations in android systems,'' in USENIX Security, 2021."},{"key":"e_1_3_2_1_57_1","volume-title":"Kalido: Real-time privacy control for eye-tracking systems,'' in USENIX Security","author":"Li J.","year":"2021","unstructured":"J. Li, A. Roy Chowdhury, K. Fawaz, and Y. Kim, ''Kalido: Real-time privacy control for eye-tracking systems,'' in USENIX Security, 2021."},{"key":"e_1_3_2_1_58_1","volume-title":"Libd: Scalable and precise third-party library detection in android markets,'' in ICSE. hskip 1em plus 0.5em minus 0.4emrelax IEEE","author":"Li M.","year":"2017","unstructured":"M. Li, W. Wang, P. Wang, S. Wang, D. Wu, J. Liu, R. Xue, and W. Huo, ''Libd: Scalable and precise third-party library detection in android markets,'' in ICSE. hskip 1em plus 0.5em minus 0.4emrelax IEEE, 2017."},{"key":"e_1_3_2_1_59_1","volume-title":"Understanding user identification in virtual reality through behavioral biometrics and the effect of body normalization,'' in CHI '21","author":"Liebers J.","year":"2021","unstructured":"J. Liebers, M. Abdelaziz, L. Mecke, A. Saad, J. Auda, U. Gruenefeld, F. Alt, and S. Schneegass, ''Understanding user identification in virtual reality through behavioral biometrics and the effect of body normalization,'' in CHI '21, 2021."},{"key":"e_1_3_2_1_60_1","volume-title":"Do customized android frameworks keep pace with android?'' in MSR","author":"Liu P.","year":"2022","unstructured":"P. Liu, M. Fazzini, J. Grundy, and L. Li, ''Do customized android frameworks keep pace with android?'' in MSR, 2022."},{"key":"e_1_3_2_1_61_1","unstructured":"P. I. P. Ltd. ''Pico os '' https:\/\/www.picoxr.com\/global\/software\/pico-os."},{"key":"e_1_3_2_1_62_1","first-page":"445","volume-title":"Holologger: Keystroke inference on mixed reality head mounted displays,'' in IEEE VR. hskip 1em plus 0.5em minus 0.4emrelax IEEE","author":"Luo S.","year":"2022","unstructured":"S. Luo, X. Hu, and Z. Yan, ''Holologger: Keystroke inference on mixed reality head mounted displays,'' in IEEE VR. hskip 1em plus 0.5em minus 0.4emrelax IEEE, 2022, pp. 445-454."},{"key":"e_1_3_2_1_63_1","volume-title":"Eavesdropping on Controller Acoustic Emanation for Keystroke Inference Attack in Virtual Reality,'' in NDSS","author":"Luo S.","year":"2024","unstructured":"S. Luo, A. Nguyen, H. Farooq, K. Sun, and Z. Yan, ''Eavesdropping on Controller Acoustic Emanation for Keystroke Inference Attack in Virtual Reality,'' in NDSS, 2024."},{"key":"e_1_3_2_1_64_1","first-page":"4517","article-title":"{Defects-in-Depth}: Analyzing the integration of effective defenses against {One-Day} exploits in android kernels","author":"Maar L.","year":"2024","unstructured":"L. Maar, F. Draschbacher, L. Lamster, and S. Mangard, ''{Defects-in-Depth}: Analyzing the integration of effective defenses against {One-Day} exploits in android kernels,'' in USENIX Security, 2024, pp. 4517-4534.","journal-title":"USENIX Security"},{"key":"e_1_3_2_1_65_1","volume-title":"Post-gdpr threat hunting on android phones: Dissecting os-level safeguards of user-unresettable identifiers.'' in NDSS","author":"Meng M. H.","year":"2023","unstructured":"M. H. Meng, Q. Zhang, G. Xia, Y. Zheng, Y. Zhang, G. Bai, Z. Liu, S. G. Teo, and J. S. Dong, ''Post-gdpr threat hunting on android phones: Dissecting os-level safeguards of user-unresettable identifiers.'' in NDSS, 2023."},{"key":"e_1_3_2_1_66_1","unstructured":"Meta ''Meta community forums '' https:\/\/communityforums.atmeta.com\/."},{"key":"e_1_3_2_1_67_1","unstructured":"--- ''Meta quest 2: Defense through offense '' https:\/\/engineering.fb.com\/2023\/09\/12\/security\/meta-quest-2-defense-through-offense\/."},{"key":"e_1_3_2_1_68_1","unstructured":"--- ''Set up your boundary for meta ques '' https:\/\/www.meta.com\/help\/quest\/articles\/in-vr-experiences\/oculus-features\/oculus-guardian\/."},{"key":"e_1_3_2_1_69_1","volume-title":"Unlocking oculus go,'' https:\/\/developers.meta.com\/horizon\/blog\/unlocking-oculus-go\/","author":"Meta","year":"2021","unstructured":"Meta, ''Unlocking oculus go,'' https:\/\/developers.meta.com\/horizon\/blog\/unlocking-oculus-go\/, 2021."},{"key":"e_1_3_2_1_70_1","volume-title":"Meta quest 3: Technical specifications","author":"Platforms Tinterwordspacing Meta","year":"2023","unstructured":"BIBentryALTinterwordspacing Meta Platforms, ''Meta quest 3: Technical specifications,'' 2023. [Online]. Available: https:\/\/www.meta.com\/quest\/quest-3\/specs\/ BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_71_1","first-page":"765","volume-title":"A keylogging inference attack on air-tapping keyboards in virtual environments,'' in IEEE VR. hskip 1em plus 0.5em minus 0.4emrelax IEEE","author":"Yildiran N. F.","year":"2022","unstructured":"\u00dc. Meteriz-Yildiran, N. F. Yildiran, A. Awad, and D. Mohaisen, ''A keylogging inference attack on air-tapping keyboards in virtual environments,'' in IEEE VR. hskip 1em plus 0.5em minus 0.4emrelax IEEE, 2022, pp. 765-774."},{"key":"e_1_3_2_1_72_1","volume-title":"Combining real-world constraints on user behavior with deep neural networks for virtual reality (vr) biometrics,'' in IEEE VR. hskip 1em plus 0.5em minus 0.4emrelax IEEE","author":"Miller R.","year":"2022","unstructured":"R. Miller, N. K. Banerjee, and S. Banerjee, ''Combining real-world constraints on user behavior with deep neural networks for virtual reality (vr) biometrics,'' in IEEE VR. hskip 1em plus 0.5em minus 0.4emrelax IEEE, 2022."},{"key":"e_1_3_2_1_73_1","volume-title":"Exploring the unprecedented privacy risks of the metaverse,'' arXiv preprint arXiv:2207.13176","author":"Nair V.","year":"2022","unstructured":"V. Nair, G. M. Garrido, and D. Song, ''Exploring the unprecedented privacy risks of the metaverse,'' arXiv preprint arXiv:2207.13176, 2022."},{"key":"e_1_3_2_1_74_1","volume-title":"Deep Motion Masking for Secure, Usable, and Scalable Real-Time Anonymization of Virtual Reality Motion Data","author":"Nair V.","year":"2023","unstructured":"V. Nair, W. Guo, J. F. O'Brien, L. Rosenberg, and D. Song, ''Deep Motion Masking for Secure, Usable, and Scalable Real-Time Anonymization of Virtual Reality Motion Data,'' Nov. 2023, arXiv:2311.05090 [cs]."},{"key":"e_1_3_2_1_75_1","first-page":"1","volume-title":"Oct.","author":"Nair V. C.","year":"2023","unstructured":"V. C. Nair, G. Munilla-Garrido, and D. Song, ''BIBforeignlanguageenGoing Incognito in the Metaverse: Achieving Theoretically Optimal Privacy-Usability Tradeoffs in VR,'' in BIBforeignlanguageenUIST. hskip 1em plus 0.5em minus 0.4emrelax San Francisco CA USA: ACM, Oct. 2023, pp. 1-16."},{"key":"e_1_3_2_1_76_1","volume-title":"Penetration Vision through Virtual Reality Headsets: Identifying 360-degree Videos from Head Movements,'' in USENIX Security","author":"Nguyen A.","year":"2024","unstructured":"A. Nguyen, X. Zhang, and Z. Yan, ''Penetration Vision through Virtual Reality Headsets: Identifying 360-degree Videos from Head Movements,'' in USENIX Security, 2024."},{"key":"e_1_3_2_1_77_1","unstructured":"NIST-CVE-Database ''Cve-2015-3864 '' https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2015-3864."},{"key":"e_1_3_2_1_78_1","volume-title":"Biomove: Biometric user identification from human kinesiological movements for virtual reality systems,'' Sensors","author":"Olade I.","year":"2020","unstructured":"I. Olade, C. Fleming, and H.-N. Liang, ''Biomove: Biometric user identification from human kinesiological movements for virtual reality systems,'' Sensors, 2020."},{"key":"e_1_3_2_1_79_1","doi-asserted-by":"publisher","DOI":"10.1145\/3290605.3300340"},{"key":"e_1_3_2_1_80_1","volume-title":"Trust, but verify: A longitudinal analysis of android oem compliance and customization,'' in S&P (Oakland). hskip 1em plus 0.5em minus 0.4emrelax IEEE","author":"Possemato A.","year":"2021","unstructured":"A. Possemato, S. Aonzo, D. Balzarotti, and Y. Fratantonio, ''Trust, but verify: A longitudinal analysis of android oem compliance and customization,'' in S&P (Oakland). hskip 1em plus 0.5em minus 0.4emrelax IEEE, 2021."},{"key":"e_1_3_2_1_81_1","first-page":"1661","article-title":"Site isolation: Process separation for web sites within the browser","author":"Reis C.","year":"2019","unstructured":"C. Reis, A. Moshchuk, and N. Oskov, ''Site isolation: Process separation for web sites within the browser,'' in USENIX Security, 2019, pp. 1661-1678.","journal-title":"USENIX Security"},{"key":"e_1_3_2_1_82_1","unstructured":"RoadToVR ''Meta has sold nearly 20 million quest headsets but retention struggles remain '' https:\/\/www.roadtovr.com\/quest-sales-20-million-retention-struggles\/."},{"key":"e_1_3_2_1_83_1","volume-title":"e, ''Anxiety level recognition for virtual reality therapy system using physiological signals,'' Electronics","author":"\u0160alkevicius J.","year":"2019","unstructured":"J. \u0160alkevicius, R. Dama\u0161evi\u010dius, R. Maskeliunas, and I. Laukien.e, ''Anxiety level recognition for virtual reality therapy system using physiological signals,'' Electronics, 2019."},{"key":"e_1_3_2_1_84_1","unstructured":"H. Sidhpurwala ''Hardening elf binaries using relocation read-only (relro) '' https:\/\/www.redhat.com\/en\/blog\/hardening-elf-binaries-using-relocation-read-only-relro."},{"key":"e_1_3_2_1_85_1","volume-title":"Virtual reality, real problems: A longitudinal security analysis of vr firmware","author":"Simhadri Tinterwordspacing V. S.","year":"2025","unstructured":"BIBentryALTinterwordspacing V. S. Simhadri, Y. Xiong, H. Farrukh, and X. Zhang, ''Virtual reality, real problems: A longitudinal security analysis of vr firmware,'' 2025. [Online]. Available: https:\/\/arxiv.org\/abs\/2509.00662 BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_86_1","volume-title":"Enhancing our lives with immersive virtual reality. frontiers in robotics and ai, 3, 74","author":"Slater M.","year":"2016","unstructured":"M. Slater and M. V. Sanchez-Vives, ''Enhancing our lives with immersive virtual reality. frontiers in robotics and ai, 3, 74,'' 2016."},{"key":"e_1_3_2_1_87_1","volume-title":"Going through the motions:{AR\/VR} keylogging from user head motions,'' in USENIX Security","author":"Slocum C.","year":"2023","unstructured":"C. Slocum, Y. Zhang, N. Abu-Ghazaleh, and J. Chen, ''Going through the motions:{AR\/VR} keylogging from user head motions,'' in USENIX Security, 2023."},{"key":"e_1_3_2_1_88_1","first-page":"20","article-title":"Security enhanced (se) android: bringing flexible mac to android","volume":"310","author":"Smalley S.","year":"2013","unstructured":"S. Smalley and R. Craig, ''Security enhanced (se) android: bringing flexible mac to android.'' in NDSS, vol. 310, 2013, pp. 20-38.","journal-title":"NDSS"},{"key":"e_1_3_2_1_89_1","unstructured":"ssut ''payload-dumper-go '' https:\/\/github.com\/ssut\/payload-dumper-go."},{"key":"e_1_3_2_1_90_1","unstructured":"Statista ''Virtual reality (vr) - statistics & facts '' https:\/\/www.statista.com\/topics\/2532\/virtual-reality-vr\/."},{"key":"e_1_3_2_1_91_1","volume-title":"Remote Keylogging Attacks in Multi-user VR Applications","author":"Su Tinterwordspacing Z.","year":"2024","unstructured":"BIBentryALTinterwordspacing Z. Su, K. Cai, R. Beeler, L. Dresel, A. Garcia, I. Grishchenko, Y. Tian, C. Kruegel, and G. Vigna, ''Remote Keylogging Attacks in Multi-user VR Applications,'' May 2024, arXiv:2405.14036 [cs]. [Online]. Available: http:\/\/arxiv.org\/abs\/2405.14036 BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_92_1","volume-title":"Firmwaredroid: Towards automated static analysis of pre-installed android apps,'' in (MOBILESoft). hskip 1em plus 0.5em minus 0.4emrelax IEEE","author":"Sutter T.","year":"2023","unstructured":"T. Sutter and B. Tellenbach, ''Firmwaredroid: Towards automated static analysis of pre-installed android apps,'' in (MOBILESoft). hskip 1em plus 0.5em minus 0.4emrelax IEEE, 2023."},{"key":"e_1_3_2_1_93_1","volume-title":"Grace et al., ''{ATtention} spanned: Comprehensive vulnerability analysis of {AT} commands within the android ecosystem,'' in USENIX Security","author":"Tian D. J.","year":"2018","unstructured":"D. J. Tian, G. Hernandez, J. I. Choi, V. Frost, C. Raules, P. Traynor, H. Vijayakumar, L. Harrison, A. Rahmati, M. Grace et al., ''{ATtention} spanned: Comprehensive vulnerability analysis of {AT} commands within the android ecosystem,'' in USENIX Security, 2018."},{"key":"e_1_3_2_1_94_1","volume-title":"You can't hide behind your headset: User profiling in augmented and virtual reality,'' arXiv preprint arXiv:2209.10849","author":"Tricomi P. P.","year":"2022","unstructured":"P. P. Tricomi, F. Nenna, L. Pajola, M. Conti, and L. Gamberini, ''You can't hide behind your headset: User profiling in augmented and virtual reality,'' arXiv preprint arXiv:2209.10849, 2022."},{"key":"e_1_3_2_1_95_1","first-page":"3789","article-title":"OVRseen: Auditing network traffic and privacy policies in oculus VR","author":"Trimananda R.","year":"2022","unstructured":"R. Trimananda, H. Le, H. Cui, J. T. Ho, A. Shuba, and A. Markopoulou, ''OVRseen: Auditing network traffic and privacy policies in oculus VR,'' in USENIX Security, 2022, pp. 3789-3806.","journal-title":"USENIX Security"},{"key":"e_1_3_2_1_96_1","unstructured":"BIBentryALTinterwordspacing R. user. (2023) Comment on the post ''can't enabled hand tracking help?''. [Online]. Available: https:\/\/www.reddit.com\/r\/MetaQuestVR\/comments\/1ihblz2\/comment\/mavwlvw\/ BIBentrySTDinterwordspacing"},{"key":"e_1_3_2_1_97_1","unstructured":"T. Verge ''Surveillance will follow us into the `metaverse' and our bodies could be its new data source '' https:\/\/www.washingtonpost.com\/technology\/2022\/01\/13\/privacy-vr-metaverse\/."},{"key":"e_1_3_2_1_98_1","unstructured":"--- ''This is meta's ar \/ vr hardware roadmap for the next four years '' https:\/\/www.theverge.com\/2023\/2\/28\/23619730\/meta-vr-oculus-ar-glasses-smartwatch-plans."},{"key":"e_1_3_2_1_99_1","volume-title":"Union under duress: Understanding hazards of duplicate resource mismediation in android software supply chain,'' in USENIX Security","author":"Wang X.","year":"2023","unstructured":"X. Wang, Y. Zhang, X. Wang, Y. Jia, and L. Xing, ''Union under duress: Understanding hazards of duplicate resource mismediation in android software supply chain,'' in USENIX Security, 2023."},{"key":"e_1_3_2_1_100_1","volume-title":"The impact of vendor customizations on android security,'' in CCS","author":"Wu L.","year":"2013","unstructured":"L. Wu, M. Grace, Y. Zhou, C. Wu, and X. Jiang, ''The impact of vendor customizations on android security,'' in CCS, 2013."},{"key":"e_1_3_2_1_101_1","volume-title":"Precise and efficient patch presence test for android applications against code obfuscation,'' in ISSTA","author":"Xie Z.","year":"2023","unstructured":"Z. Xie, M. Wen, H. Jia, X. Guo, X. Huang, D. Zou, and H. Jin, ''Precise and efficient patch presence test for android applications against code obfuscation,'' in ISSTA, 2023."},{"key":"e_1_3_2_1_102_1","unstructured":"XRToday ''Virtual reality security and privacy '' https:\/\/www.xrtoday.com\/virtual-reality\/virtual-reality-security-and-privacy\/."},{"key":"e_1_3_2_1_103_1","volume-title":"Can Virtual Reality Protect Users from Keystroke Inference Attacks?'' arXiv preprint arXiv:2310.16191","author":"Yang Z.","year":"2023","unstructured":"Z. Yang, Z. Sarwar, I. Hwang, R. Bhaskar, B. Y. Zhao, and H. Zheng, ''Can Virtual Reality Protect Users from Keystroke Inference Attacks?'' arXiv preprint arXiv:2310.16191, 2023."},{"key":"e_1_3_2_1_104_1","volume-title":"Zou et al., ''Sepal: Towards a large-scale analysis of seandroid policy customization,'' in WWW","author":"Yu D.","year":"2021","unstructured":"D. Yu, G. Yang, G. Meng, X. Gong, X. Zhang, X. Xiang, X. Wang, Y. Jiang, K. Chen, W. Zou et al., ''Sepal: Towards a large-scale analysis of seandroid policy customization,'' in WWW, 2021."},{"key":"e_1_3_2_1_105_1","volume-title":"Building embedded systems like it's","author":"Yu R.","year":"1996","unstructured":"R. Yu, F. Del Nin, Y. Zhang, S. Huang, P. Kaliyar, S. Zakto, M. Conti, G. Portokalidis, and J. Xu, ''Building embedded systems like it's 1996,'' in NDSS, 2022."},{"key":"e_1_3_2_1_106_1","doi-asserted-by":"publisher","DOI":"10.1145\/3324884.3416582"},{"key":"e_1_3_2_1_107_1","first-page":"1746","article-title":"Vpvet: Vetting privacy policies of virtual reality apps","author":"Zhan Y.","year":"2024","unstructured":"Y. Zhan, Y. Meng, L. Zhou, Y. Xiong, X. Zhang, L. Ma, G. Chen, Q. Pei, and H. Zhu, ''Vpvet: Vetting privacy policies of virtual reality apps,'' in CCS, 2024, pp. 1746-1760.","journal-title":"CCS"},{"key":"e_1_3_2_1_108_1","first-page":"559","volume-title":"Practical control flow integrity and randomization for binary executables,'' in S&P (Oakland). hskip 1em plus 0.5em minus 0.4emrelax IEEE","author":"Zhang C.","year":"2013","unstructured":"C. Zhang, T. Wei, Z. Chen, L. Duan, L. Szekeres, S. McCamant, D. Song, and W. Zou, ''Practical control flow integrity and randomization for binary executables,'' in S&P (Oakland). hskip 1em plus 0.5em minus 0.4emrelax IEEE, 2013, pp. 559-573."},{"key":"e_1_3_2_1_109_1","volume-title":"Precise and accurate patch presence test for binaries,'' in USENIX Security","author":"Zhang H.","year":"2018","unstructured":"H. Zhang and Z. Qian, ''Precise and accurate patch presence test for binaries,'' in USENIX Security, 2018."},{"key":"e_1_3_2_1_110_1","volume-title":"Libid: reliable identification of obfuscated third-party android libraries,'' in ISSTA","author":"Zhang J.","year":"2019","unstructured":"J. Zhang, A. R. Beresford, and S. A. Kollmann, ''Libid: reliable identification of obfuscated third-party android libraries,'' in ISSTA, 2019."},{"key":"e_1_3_2_1_111_1","volume-title":"It's all in your head (set): Side-channel attacks on ar\/vr systems,'' in USENIX Security","author":"Zhang Y.","year":"2023","unstructured":"Y. Zhang, C. Slocum, J. Chen, and N. Abu-Ghazaleh, ''It's all in your head (set): Side-channel attacks on ar\/vr systems,'' in USENIX Security, 2023."},{"key":"e_1_3_2_1_112_1","first-page":"3649","article-title":"An investigation of the android kernel patch ecosystem","author":"Zhang Z.","year":"2021","unstructured":"Z. Zhang, H. Zhang, Z. Qian, and B. Lau, ''An investigation of the android kernel patch ecosystem,'' in USENIX Security, 2021, pp. 3649-3666.","journal-title":"USENIX Security"},{"key":"e_1_3_2_1_113_1","volume-title":"The peril of fragmentation: Security hazards in android device driver customizations,'' in S&P (Oakland). hskip 1em plus 0.5em minus 0.4emrelax IEEE","author":"Zhou X.","year":"2014","unstructured":"X. Zhou, Y. Lee, N. Zhang, M. Naveed, and X. Wang, ''The peril of fragmentation: Security hazards in android device driver customizations,'' in S&P (Oakland). hskip 1em plus 0.5em minus 0.4emrelax IEEE, 2014."}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","location":"Taipei Taiwan","acronym":"CCS '25","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3765102","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:13:47Z","timestamp":1766441627000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3719027.3765102"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,19]]},"references-count":113,"alternative-id":["10.1145\/3719027.3765102","10.1145\/3719027"],"URL":"https:\/\/doi.org\/10.1145\/3719027.3765102","relation":{},"subject":[],"published":{"date-parts":[[2025,11,19]]},"assertion":[{"value":"2025-11-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}