Shadowed Realities - An Investigation of UI Attacks in WebXR

Explore a comprehensive security research presentation examining UI vulnerabilities and dark design patterns in WebXR environments. Learn about five novel attack techniques that exploit WebXR's unique properties, including how third parties can inject malicious JavaScript scripts to induce unintentional user clicks and extract sensitive information. Discover a systematic taxonomy categorizing both existing and newly identified attacks within the advertising domain, and understand how the absence of traditional web security elements like iframes creates new exploitation opportunities. Examine findings from a 100-participant user study that reveals how dark patterns in immersive 3D environments largely go unnoticed while effectively achieving malicious goals, with impacts varying by attack category and application type. Gain insights into spatial data collection methods for 3D user interactions, specialized metrics for analyzing user behavior in virtual environments, and the development of logging frameworks integrated across different WebXR applications. Understand the implications for developers seeking to improve security practices and researchers working to develop robust defense mechanisms for protecting user data in immersive web platforms.