Shadowed Realities: An Investigation of UI Attacks in WebXR
summary
WebXR exposes 14 security‑sensitive UI properties and the authors implement five novel UI attacks (visual overlapping, sequential rendering, malvertising, GUI switch, DOM overriding), build a logging framework with A-Frame and 3JS that captures 3D spatial events and intentional vs unintentional clicks, and run a 100‑participant between‑subjects study across reading, gaming, shopping, and travel apps. Results show most dark patterns go unnoticed yet produce significant unintended clicks and inflated impressions, and all artifacts and metrics are released for developers and researchers.
AI-written summary · about
chapters (9)
- 0:00WebXR introduction
- 1:37What is WebXR
- 3:04WebXR UI security risks
- 4:27Dark patterns in ads
- 7:17Novel UI attacks in ads
- 9:22User study design
- 11:30Logging for attack detection
- 13:39User study results
- 15:24Conclusion and future measures
related talks
33mWebXR A New Dimension For The Web
43mWebXR, if X = how?
32mWriting Virtual and Augmented Reality Apps with Web Technology
21mDown the rabbit hole with WebVR
10mInvestigating Security Indicators for Hyperlinking Within the Metaverse
23mBuilding Engaging Immersive Experiences
21mCreepy frontend mistakes
33mWebXR? Native virtual and augmented reality in browsers