Pith. sign in

REVIEW 5 major objections 5 minor 114 references

Virtual Reality, Real Problems: A Longitudinal Security Analysis of VR Firmware

T0 review · 5 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read VR firmware drops many core Android security protections

desk verdict First longitudinal VR firmware security audit, but the binary-hardening detector needs validation before the headline numbers are credible. read the letter →

arxiv 2509.00662 v2 pith:ZJ7OS4CD submitted 2025-08-31 cs.CR

Vamsi Shankar Simhadri , Yichang Xiong , Habiba Farrukh , Xiaokuan Zhang This is my paper · ORCID
classification cs.CR
keywords VRfirmwaresecurityAndroidbinaryhardeningSELinuxpolicypermissionanalysisMetaQuestPicolongitudinal
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper presents the first longitudinal security audit of virtual-reality firmware, covering more than 300 releases from Meta Quest and Pico headsets between 2019 and 2024. It argues that these devices are built on customized Android yet fail to carry over Android's standard defense-in-depth: kernel mitigations are missing or stale, thousands of system binaries lack basic hardening, app permission enforcement is inconsistent, and SELinux policies are weakened. If correct, this means VR headsets—which collect eye tracking, body motion, and environmental data—are less protected than the Android phones they derive from. The authors support the claim with static analysis of firmware images across kernel, binary, application, and policy layers, and they recommend a VR-specific compliance baseline.

What carries the argument

The analysis is carried by a multi-layer static-analysis pipeline for fragmented VR firmware. For each image it extracts the kernel configuration via an embedded-config extraction script, checks ELF binaries for standard hardening markers (stack canaries, CFI, Fortify Source, NX, RELRO), parses Android app manifests for security flags and permissions, and parses SEPolicy .cil files for allow and never-allow rules. It then compares the results longitudinally and, where relevant, against the Android Compatibility Definition Document as the security baseline Android devices are expected to meet.

What would settle it

Obtain root or a hardware test unit on a current Quest or Pico headset and attempt the concrete attacks implied by the findings: run an app with use_cleartext_traffic to a controlled server and intercept the traffic, request ORTHOFIT_DATA or FACE_EYE_INTERNAL_API from a third-party app, and try to read the vendor property files Pico exposes to untrusted domains. If none of these succeed despite the static flags, the paper's risk claims are weaker; if any succeed, the static indicators are validated.

Watch

Extended reading notes

Core claim

The central claim is that VR firmware, as shipped by Meta and Pico in over 300 versions from 2019 to 2024, does not maintain the security baseline of modern Android. No tested firmware enables all 17 kernel mitigations the authors check; devices run long-term-support kernels that are years behind the latest stable release. Across every device, Control Flow Integrity and Fortify Source are absent from thousands of system binaries, weakening defenses against control-flow hijacking and buffer overflows. Manifest security flags vary inconsistently, and sensitive permissions such as FACE_EYE_INTERNAL_API and ORTHOFIT_DATA have been downgraded from preinstalled-only to dangerous, opening them to t

Load-bearing premise

The findings assume that what static analysis reveals—kernel config flags, binary hardening markers, manifest settings, and SELinux rules—reflects the device's actual security posture; vendor responses argue that runtime layers change the meaning of these flags, such as an HTTPS-enforcing library neutralizing the cleartext setting.

Editorial extensions

If this is right

  • VR devices are exposed to privilege escalation and memory-corruption attacks that standard Android kernel and binary mitigations would block.
  • Newer Quest models improve their posture over time, while Pico shows no longitudinal improvement and continues to ship the same kernel and missing mitigations.
  • Downgraded permission protection levels make sensitive VR tracking data (face, eye, body) requestable by third-party apps with user consent, expanding the attack surface beyond traditional Android.
  • Weakened SELinux policies on Pico allow untrusted apps to access vendor property files containing device identifiers, enabling fingerprinting and tracking.
  • Because no VR-specific compliance standard exists, vendors have no enforceable baseline; the paper recommends a CDD-like framework for VR.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If vendor rebuttals hold, some specific findings (e.g., cleartext traffic) may not be exploitable as described, but the broader pattern—missing binary hardening and stale kernels—still warrants concern; the absence of CFI and Fortify across thousands of binaries makes it likely that at least some are exploitable in practice.
  • The same static methodology could be applied to upcoming Android XR devices to check whether the next wave of headsets inherits or fixes these gaps.
  • A testable extension is dynamic analysis: rooting an older device (e.g., Oculus Go) or using vendor test units to attempt the attacks implied by the findings would verify whether static flags translate into real vulnerabilities.
  • The permission protection-level transitions observed on Quest devices suggest a staged rollout pattern; a deeper study could determine whether the window before the system-level controls are added is exploitable.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper presents a longitudinal static analysis of firmware from Meta Quest (Quest 1/2/3/Pro) and Pico (Neo 3/4), spanning over 300 firmware versions from 2019 to 2024. It extracts kernel .config files, checks binary hardening indicators (canaries, CFI, Fortify, NX, RELRO), analyzes manifest security flags and permissions of preinstalled apps, and counts SELinux allow/never-allow rules. The paper's central claim is that VR firmware systematically lacks Android-standard security mitigations at the kernel, binary, application, and SELinux policy layers, and it synthesizes recommendations for vendors, developers, and manufacturers. The work is positioned as the first comprehensive, multi-layer, longitudinal security analysis of VR firmware.

Significance. If the findings hold, this is a valuable and timely measurement contribution: it assembles a large firmware corpus, provides a reproducible extraction/analysis pipeline (code and data are promised open source), and extends Android firmware security measurement to a fast-growing but understudied device class. The direct extraction of kernel .config via IKCONFIG, the longitudinal design across four Quest product lines, and the responsible disclosure process are clear strengths. The central weakness is that the binary-hardening findings (RQ2) rest on static symbol/string markers whose validity is not established, and several causal/security-relevant interpretations are challenged by the vendors' own rebuttals in §8.2. The paper is not circular: the measurements are direct extractions compared against external baselines, and no fitted parameters are used. Overall, the contribution is real but the strength of several headline claims currently exceeds what the static methodology can support.

major comments (5)
  1. [§8.2, §8.4, §6.3.1] The RQ2 binary-hardening measurement is load-bearing for the conclusion 'consistent absence of CFI and Fortify Source across thousands of binaries,' but the detector is unvalidated and likely has high false-negative rates on stripped production firmware. CFI detection by looking for '.cfi' symbols is not the standard signature of LLVM CFI as deployed in Android; the expected artifacts are __cfi_check/__cfi_slowpath and associated jump tables, and stripped binaries may contain none of these symbols. Fortify detection via '*_chk' dynamic symbols similarly misses statically linked or stripped binaries. The paper reports no ground-truth validation against AOSP/GKI or other builds with known compiler flags, and §8.4 acknowledges that no dynamic analysis was possible. I ask the authors to either validate the detector on a corpus with known build flags (e.g., AOSP binaries, GKI kernels) or subs
  2. [Table 1, §4.3, §5.3] The paper reports vendor rebuttals that directly weaken the security-relevant interpretation of its static findings: Pico states that the use_cleartext_traffic flag is neutralized by a proprietary HTTPS-enforcing network library, and Meta states that permission level changes (e.g., ORTHOFIT_DATA, FACE_EYE_INTERNAL_API) are backed by system-level access controls restricting use to authorized apps. These responses are not verified or even explicitly weighed against the paper's own conclusions. Consequently, statements such as 'VR devices are prone to ... exposure to MITM attacks' (§6.3.1 summary) and 'critical security issues' (Conclusion) are stronger than the static evidence supports. The limitation in §8.4 (no source code, no dynamic analysis, no PoCs) is acknowledged, but it should be carried through to the abstract and conclusion language. At minimum, the paper should present the vend
  3. [§4.2, Table 4] The Pico longitudinal analysis rests on only four firmware versions per device (Pico Neo 3 and Pico 4), all on Android 10, with sparse coverage over the date range. Claims such as 'there is no positive trend in adopting newer mitigations' (§4.3), 'Pico devices show no evident longitudinal change' (§4.3), and the Pico trends in Figures 4–8 cannot be distinguished from sampling artifacts with n=4. The Pico results should be presented as a cross-sectional snapshot, not as longitudinal evidence, or the authors should collect additional Pico versions. This does not affect the Meta analysis, but it does affect the paper's global framing of vendor-level longitudinal comparison.
  4. [§4.3, Table 3] The RQ1 methodology checks 17 kernel mitigations against the Android CDD and prior work [64], but it does not establish which of these mitigations are actually available in the kernel versions and SoC toolchains used by the VR devices. For example, CONFIG_CFI_CLANG and CONFIG_SHADOW_CALL_STACK may not be supported on Linux 4.4/4.19 or by the specific compiler/toolchain used for those devices; CONFIG_INIT_ON_ALLOC_DEFAULT_ON only became relevant in later kernels. Table 4 lists these as 'missing' without checking availability. The claim that VR devices 'lag behind Android standards' would be strengthened by comparing against actual AOSP/GKI kernel configs for the corresponding Android versions, or at least by explicitly reporting which flags are simply unavailable on the older kernel base. Without this, some of the RQ1 findings conflate deliberate vendor choices with kernel-version constra
  5. The kernel-version comparison in Table 3 uses the latest LTS kernel available at release time as the baseline, but this conflates version age with security exposure. Linux 4.4 was still under LTS maintenance in 2019, and 4.19 remains LTS through the entire data-collection window; an older LTS kernel can be secure if actively patched. The more security-relevant measure is patch level and backport coverage, which the paper does not measure. The 'delayed adoption' narrative is well known from prior Android work and is plausible, but it is not directly supported by the data presented here. I suggest either rephrasing the kernel-version finding as 'old LTS base' rather than 'insecure,' or adding an analysis of kernel patch level (e.g., via CVE backport checks).
minor comments (5)
  1. [Abstract / Table 1] Typo: 'vender.img' should be 'vendor.img' in Figure 2.
  2. The text says the dataset spans 'March 2019 to December 2024,' but Table 1 lists the Quest date range as 'June 2019 - December 2023.' Please reconcile this discrepancy.
  3. Formatting issue in Table 2: several CONFIG_ options are run together (e.g., 'CONFIG_HAVE_STACKPROTECTORorCONFIG_STACKPROTECTOR'), making the table hard to read. Please insert proper spacing or use a separate column.
  4. The claim that 'Quest devices have a low number of apps with the use_cleartext_traffic flag set' is relative; the table shows Quest 1 has 6 and Quest 2/3/Pro have 9 apps with this flag. Consider reporting these as absolute counts with context, since 9 is not negligible for a system image.
  5. Minor grammar: 'Except Oculus Go' should be 'except for Oculus Go.'

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: all findings are direct measurements against external Android baselines; the sole self-citation (VPVet in related work) is non-load-bearing.

full rationale

The derivation chain is a measurement pipeline, not a fitted model. RQ1 extracts each kernel's embedded .config with extract-ikconfig and checks 17 mitigations from the Android CDD and prior work [64]; the counts are direct and the comparison standard is external. RQ2 detects stack canaries, CFI, Fortify, NX, and RELRO using standard static markers adapted from [80,104]; there is no parameter fitted to VR data, so the conclusion that CFI/Fortify are often absent is a summary of those measurements, not an input renamed as a result. The main risk is measurement validity on stripped binaries, which the paper itself flags in §8.4 ('No dynamic analysis' and 'no source code available'); that is a correctness limitation, not circularity. RQ3 and RQ4 similarly report manifest-flag counts, permission protection levels, and SEPolicy allow/neverallow rule counts directly parsed from firmware artifacts; vendor rebuttals in §8.2 contest the security interpretation, not the derivation chain. The only self-citation, VPVet [106] in Section 9, is used purely to position related work ('a tool named VPVet [106] was developed to evaluate the privacy policies of VR applications') and is not load-bearing. No uniqueness theorem, ansatz, or fitted quantity is imported from the authors' prior work. The paper is self-contained against external benchmarks, so circularity is negligible.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

No free parameters or invented entities. The analysis is static and presupposes that Android CDD and AOSP conventions are the right benchmarks for VR, that extracted configs and binary signals reflect shipped builds, that forum-collected firmware is authentic, and that fewer never-allow rules implies weaker enforcement. These are explicit or implicit domain assumptions, acknowledged as limitations in §8.4.

assumptions (5)
  • domain assumption Android's CDD and AOSP conventions are the appropriate security yardstick for VR devices
    The entire study evaluates VR firmware against Android CDD and AOSP conventions (§2.4, §4.2); this presupposes that Android's security standards are applicable and beneficial for VR devices.
  • domain assumption Static detection of hardening features via binary symbols, GOT entries, and ELF segments reflects deployed protections
    RQ2 methodology (§5.2) infers canaries/CFI/Fortify/NX/RELRO from symbol tables and segment flags without runtime validation.
  • domain assumption Kernel .config extracted from binaries via extract-ikconfig mirrors the actual build configuration
    RQ1 relies on CONFIG_IKCONFIG being compiled in, and assumes the embedded config was not stale or modified; §4.2 states all kernels had the flag.
  • domain assumption Public firmware images archived online are authentic, unmodified vendor releases
    Dataset collected from forums and archives (§3.2); no hashes cross-checked against vendor channels for all versions.
  • domain assumption Removal of never-allow rules and exposure of property files to untrusted domains degrades security
    RQ4 interpretation (§7.3) equates fewer never-allow rules and accessible vendor properties with weaker enforcement, without demonstrating exploitability.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Virtual Reality, Real Problems: A Longitudinal Security Analysis of VR Firmware." pith.science (2026). https://pith.science/paper/ZJ7OS4CD

@misc{pith2026250900662,
  author       = {Pith},
  title        = {Pith review of: Virtual Reality, Real Problems: A Longitudinal Security Analysis of VR Firmware},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZJ7OS4CD}},
  note         = {Machine review of arXiv:2509.00662}
}
read the original abstract

Virtual Reality (VR) technology is rapidly growing in recent years. VR devices such as Meta Quest 3 utilize numerous sensors to collect users' data to provide an immersive experience. Due to the extensive data collection and the immersive nature, the security of VR devices is paramount. Leading VR devices often adopt and customize Android systems, which makes them susceptible to both Android-based vulnerabilities and new issues introduced by VR-specific customizations (e.g., system services to support continuous head and hand tracking). While prior work has extensively examined the security properties of the Android software stack, how these security properties hold for VR systems remains unexplored. In this paper, we present the first comprehensive security analysis of VR firmware. We collect over 300 versions of VR firmware from two major vendors, Quest and Pico, and perform a longitudinal analysis across the kernel layer, the system binary and library layer, and the application layer. We have identified several security issues in these VR firmware, including missing kernel-level security features, insufficient binary hardening, inconsistent permission enforcement, and inadequate SELinux policy enforcement. Based on our findings, we synthesize recommendations for VR vendors to improve security and trust for VR devices. This paper will act as an important security resource for VR developers, users, and vendors, and will also direct future advancements in secure VR ecosystem.

Figures

Figures reproduced from arXiv: 2509.00662 by the authors.

Figure 1
Figure 1. VR Firmware 2 Background 2.1 VR Device Types Virtual Reality (VR) offers immersive 3D experiences via advanced head-mounted displays (HMDs) [85]. The combination of market opportunities and technology innovation has driven significant investments by major tech companies in proprietary VR platforms [12]. VR systems are categorized into four types based on architec￾ture: (1) Basic Optical VR [40] (e.g., Google Cardboa… view at source ↗
Figure 2
Figure 2. High-level Approach from March 2019 to December 2024, and total more than 700GB in size [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Kernel mitigations adopted by the VR devices; for Pico [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (14 more)
Figure 4
Figure 4. Figure 4: Binaries without Canaries 2020 2021 2022 2023 2024 2025 Year 0 500 1000 1500 2000 2500 3000 3500 4000 Pico 3 Neo Pico 4 Quest 1 Quest 2 Quest 3 Quest Pro [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 7
Figure 7. Figure 7: Binaries without NX 2020 2021 2022 2023 2024 2025 Year 0 30 60 90 120 150 180 210 240 270 Pico 3 Neo Pico 4 Quest 1 Quest 2 Quest 3 Quest Pro [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Binaries without RELRO around 50-60 through 2020. In early 2021, it drops sharply again to near zero and remains at that minimal level through 2023. Quest 2 starts in late 2020 with a count much lower than Quest 1’s initial values. It maintains this level through 2022-…
Figure 11
Figure 11. Figure 11: Phantom and Residual Permissions of Quest 2 versions of Quest 2. Several apps consistently show very high per￾mission counts across all firmware versions, such as SystemUX.apk, OCMS.apk and VrShell.apk. Change of permission protection levels. In early versions of the …
Figure 9
Figure 9. Figure 9: Permission Changes of Quest 2 v1 v51 v101 v151 Version 0 15 30 45 60 75 90 105 120 135 User launchable apps Android system apps Vendor specific apps [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: App Categorization of Quest2 permissions have remained relatively stable across firmware ver￾sions, while normal, signature, and SignatureOrSystem permis￾sions show steady growth over time. others permissions experi￾enced a significant rise, escalating from approximat…
Figure 12
Figure 12. Figure 12: Top-20 Vendor apps with highest permission numbers in Quest 2. [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]
Figure 13
Figure 13. Figure 13: shows the evolution of SEPolicy rules across different VR devices. Longitudinally, the number of never-allow rules remains stable for all devices. The only increase appeared in 2023 for Quest 2, where it upgraded from Android 10 to 12. For allow rules, the 2021 2022 2…
Figure 14
Figure 14. Figure 14: Quest 1 permissions v1 v13 v25 v37 Version 0 400 800 1200 1600 2000 2400 2800 3200 Permission Count Dangerous Normal Signature SignatureOrSystem Others App Count 0 30 60 90 120 150 180 210 240 270 Number of Apps [PITH_FULL_IMAGE:figures/full_fig_p016_14.png]
Figure 17
Figure 17. Figure 17: Phantom and Residual Permis￾sions of Quest 1 v1 v13 v25 v37 Version 0 40 80 120 160 200 240 280 320 360 400 Phantom Permissions Residual Permissions [PITH_FULL_IMAGE:figures/full_fig_p016_17.png]
Figure 20
Figure 20. Figure 20: App Categorization of Quest 1 v1 v13 v25 v37 Version 0 20 40 60 80 100 120 140 160 User launchable apps Android system apps Vendor specific apps [PITH_FULL_IMAGE:figures/full_fig_p017_20.png]
Figure 23
Figure 23. Figure 23: Top-20 vendor apps with highest permission numbers [PITH_FULL_IMAGE:figures/full_fig_p017_23.png]
Figure 24
Figure 24. Figure 24: Top-20 vendor apps with highest permission numbers [PITH_FULL_IMAGE:figures/full_fig_p017_24.png]
Figure 25
Figure 25. Figure 25: Top-20 vendor apps with highest permission numbers [PITH_FULL_IMAGE:figures/full_fig_p017_25.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

114 extracted references · 74 canonical work pages

  1. [64]

    {Defects-in-Depth}: Analyzing the integration of effective defenses against{One-Day} exploits in android kernels,

    L. Maar, F. Draschbacher, L. Lamster, and S. Mangard, “{Defects-in-Depth}: Analyzing the integration of effective defenses against{One-Day} exploits in android kernels, ” inUSENIX Security, 2024, pp. 4517–4534

    work page 2024

  2. [1]

    Hardening (computing) - Wikipedia — en.wikipedia.org,

    “Hardening (computing) - Wikipedia — en.wikipedia.org, ” https: //en.wikipedia.org/wiki/Hardening_(computing)

  3. [2]

    Htc community forum,

    “Htc community forum, ” https://forum.htc.com/

  4. [3]

    Ikconfig - linux kernel configuration database (lkddb),

    “Ikconfig - linux kernel configuration database (lkddb), ” https://cateee.net/lkddb/ web-lkddb/IKCONFIG.html

  5. [4]

    Harvesting inconsistent security configurations in custom android{ROMs} via differential analysis,

    Y. Aafer, X. Zhang, and W. Du, “Harvesting inconsistent security configurations in custom android{ROMs} via differential analysis, ” inUSENIX Security, 2016

    2016

  6. [5]

    Vr-spy: A side-channel attack on virtual key-logging in vr headsets,

    A. Al Arafat, Z. Guo, and A. Awad, “Vr-spy: A side-channel attack on virtual key-logging in vr headsets, ” inIEEE VR. IEEE, 2021, pp. 564–572

    2021

  7. [6]

    Brotli compressed data format,

    J. Alakuijala and Z. Szabadka, “Brotli compressed data format, ” RFC 7932. [Online]. Available: https://www.rfc-editor.org/info/rfc7932

  8. [7]

    Permissions on android,

    Android Developers, “Permissions on android, ” https://developer.android.com/ guide/topics/permissions/overview

Show all 114 references
  1. [8]

    Use of native code,

    ——, “Use of native code, ” 2025. [Online]. Available: https:// developer.android.com/privacy-and-security/risks/use-of-native-code

    2025

  2. [9]

    Architecture overview,

    Android Open Source Project, “Architecture overview, ” 2025. [Online]. Available: https://source.android.com/docs/core/architecture

    2025

  3. [10]

    Compatibility definition document,

    ——, “Compatibility definition document, ” 2025. [Online]. Available: https: //source.android.com/docs/compatibility/cdd

    2025

  4. [11]

    Introducing apple vision pro,

    Apple, “Introducing apple vision pro, ” https://www.apple.com/apple-vision- pro/

  5. [12]

    Consumer and enterprise virtual reality (vr) market revenue worldwide from 2021 to 2026 (in billion u.s. dollars),

    AR Insider, “Consumer and enterprise virtual reality (vr) market revenue worldwide from 2021 to 2026 (in billion u.s. dollars), ” 2022. [Online]. Available: https://www.statista.com/statistics/1221522/virtual-reality-market- size-worldwide/

    2021

  6. [13]

    Pico os software,

    I. Archive, “Pico os software, ” 2025. [Online]. Available: https://web.archive.org/ web/20250000000000*/https://www.picoxr.com/global/software/pico-os

    2025

  7. [14]

    Exploring the uncoordinated privacy protections of eye tracking and vr motion data for unauthorized user identification,

    S. Aziz and O. Komogortsev, “Exploring the uncoordinated privacy protections of eye tracking and vr motion data for unauthorized user identification, ” inIEEE VR. IEEE, 2025, pp. 217–227

    2025

  8. [15]

    Reliable third-party library detection in android and its security applications,

    M. Backes, S. Bugiel, and E. Derr, “Reliable third-party library detection in android and its security applications, ” inCCS, 2016

    2016

  9. [16]

    Exploring user reactions and mental models towards perceptual manipulation attacks in mixed reality,

    K. Cheng, J. F. Tian, T. Kohno, and F. Roesner, “Exploring user reactions and mental models towards perceptual manipulation attacks in mixed reality, ” in USENIX Security, 2023

    2023

  10. [17]

    Valve index headset technical specifications,

    V. Corporation, “Valve index headset technical specifications, ” 2019. [Online]. Available: https://www.valvesoftware.com/en/index/headset

    2019

  11. [18]

    Global XR (AR & VR Headsets) Market Share: Quarterly,

    Counterpoint Research, “Global XR (AR & VR Headsets) Market Share: Quarterly, ” https://www.counterpointresearch.com/insight/global-xr-ar-vr- headsets-market-share-quarterly, 2025

    2025

  12. [19]

    CVE, “Cve, ” https://nvd.nist.gov/vuln/detail/cve-2018-9568

    2018

  13. [20]

    The performance cost of shadow stacks and stack canaries,

    T. H. Dang, P. Maniatis, and D. Wagner, “The performance cost of shadow stacks and stack canaries, ” inAsiaCCS, 2015, pp. 555–566

    2015

  14. [21]

    CVE-2018-9525 Detail,

    N. V. Database, “CVE-2018-9525 Detail, ” https://nvd.nist.gov/vuln/detail/CVE- 2018-9525, 2018

    2018

  15. [22]

    Keep me updated: An empirical study of third-party library updatability on android,

    E. Derr, S. Bugiel, S. Fahl, Y. Acar, and M. Backes, “Keep me updated: An empirical study of third-party library updatability on android, ” inCCS, 2017

    2017

  16. [23]

    Androguard: Reverse engineering, malware and goodware analysis of android applications,

    A. Desnoset al., “Androguard: Reverse engineering, malware and goodware analysis of android applications, ” https://github.com/androguard/androguard, 2011–2024

    2011

  17. [24]

    Xda developers forums,

    X. Developers, “Xda developers forums, ” https://xdaforums.com/

  18. [25]

    On the (in)security of non-resettable device identifiers in custom android systems,

    Z. Dong, L. Wang, G. Xu, and H. Wang, “On the (in)security of non-resettable device identifiers in custom android systems, ”arXiv preprint arXiv:2502.15270, 2025

    2025 arXiv

  19. [26]

    Differential Privacy,

    C. Dwork, “Differential Privacy, ” inAutomata, Languages and Programming. Berlin, Heidelberg: Springer Berlin Heidelberg, 2006, vol. 4052, pp. 1– 12, series Title: Lecture Notes in Computer Science. [Online]. Available: http://link.springer.com/10.1007/11787006_1

    2006 doi

  20. [27]

    Differential Privacy: A Survey of Results,

    ——, “Differential Privacy: A Survey of Results, ” inTheory and Applications of Models of Computation. Berlin, Heidelberg: Springer Berlin Heidelberg, 2008, vol. 4978, pp. 1–19, series Title: Lecture Notes in Computer Science. [Online]. Available: http://link.springer.com/10.10...

    2008 doi

  21. [28]

    Dissecting residual apis in custom android roms,

    Z. El-Rewini and Y. Aafer, “Dissecting residual apis in custom android roms, ” in CCS, 2021

    2021

  22. [29]

    Electronics,Samsung Gear VR Operating Instructions, 2015

    S. Electronics,Samsung Gear VR Operating Instructions, 2015. [Online]. Available: https://www.bhphotovideo.com/lit_files/132118.pdf

    2015

  23. [30]

    Sausage: security analysis of unix domain socket usage in android,

    M. Elgharabawy, B. Kojusner, M. Mannan, K. R. Butler, B. Williams, and A. Youssef, “Sausage: security analysis of unix domain socket usage in android, ” in(EuroS&P). IEEE, 2022

    2022

  24. [31]

    Vr firmware download - quest series,

    ellie, “Vr firmware download - quest series, ” https://cocaine.trade/

  25. [32]

    {FIRMSCOPE}: Automatic uncovering of {Privilege-Escalation} vulnerabilities in {Pre- Installed}apps in android firmware,

    M. Elsabagh, R. Johnson, A. Stavrou, C. Zuo, Q. Zhao, and Z. Lin, “{FIRMSCOPE}: Automatic uncovering of {Privilege-Escalation} vulnerabilities in {Pre- Installed}apps in android firmware, ” inUSENIX Security, 2020

    2020

  26. [33]

    An analysis of pre-installed android software,

    J. Gamba, M. Rashed, A. Razaghpanah, J. Tapiador, and N. Vallina-Rodriguez, “An analysis of pre-installed android software, ” inS&P (Oakland). IEEE, 2020

    2020

  27. [34]

    Virtual reality use increases concerns for child safety, study shows,

    gameishard, “Virtual reality use increases concerns for child safety, study shows, ” https://gameishard.gg/news/over-75-believe-kids-at-major-risk-of- sexual-abuse-when-using-vr-headsets-report/92677/

  28. [35]

    Unreal engine forums,

    E. Games, “Unreal engine forums, ” https://forums.unrealengine.com/

  29. [36]

    Boot-img-extractor,

    Github, “Boot-img-extractor, ” https://github .com/cfig/ Android_boot_image_editor

  30. [37]

    Extract-ikconfig,

    ——, “Extract-ikconfig, ” https://github.com/torvalds/linux/blob/master/scripts/ extract-ikconfig

  31. [38]

    Github,

    ——, “Github, ” https://github.com/QuestEscape/exploit/tree/master/CVE-2018- 9568_WrongZone

    2018

  32. [39]

    Android security bulletins,

    Google, “Android security bulletins, ” https://source.android.com/docs/security/ bulletin/asb-overview

  33. [40]

    Specifications for viewer design - cardboard manufacturer help,

    ——, “Specifications for viewer design - cardboard manufacturer help, ” 2015. [Online]. Available: https://support .google.com/cardboard/manufacturers/ answer/6323398?hl=en

    2015

  34. [41]

    Hardening the kernel in android oreo,

    ——, “Hardening the kernel in android oreo, ” https://android- developers.googleblog.com/2017/08/hardening-kernel-in-android-oreo .html, 2017

    2017

  35. [42]

    Android xr: The gemini era comes to headsets and glasses,

    ——, “Android xr: The gemini era comes to headsets and glasses, ” 2025. [Online]. Available: https://blog.google/products/android/android-xr/

    2025

  36. [43]

    The compatibility test suite (cts) overview,

    ——, “The compatibility test suite (cts) overview, ” https://source.android.com/ docs/compatibility/cts, 2025

    2025

  37. [44]

    Hidden reality: caution, your hand gesture inputs in the immersive virtual world are visible to all!

    S. R. K. Gopal, D. Shukla, J. D. Wheelock, and N. Saxena, “Hidden reality: caution, your hand gesture inputs in the immersive virtual world are visible to all!” in USENIX Security, 2023, pp. 859–876

    2023

  38. [45]

    An empirical study on oculus virtual reality applications: Security and privacy perspectives,

    H. Guo, H.-N. Dai, X. Luo, Z. Zheng, G. Xu, and F. He, “An empirical study on oculus virtual reality applications: Security and privacy perspectives, ” inICSE, 2024, pp. 1–13

    2024

  39. [46]

    {BigMAC}:{Fine-Grained} policy analysis of android firmware,

    G. Hernandez, D. J. Tian, A. S. Yadav, B. J. Williams, and K. R. Butler, “{BigMAC}:{Fine-Grained} policy analysis of android firmware, ” inUSENIX Security, 2020

    2020

  40. [47]

    Large-scale security measurements on the android firmware ecosystem,

    Q. Hou, W. Diao, Y. Wang, X. Liu, S. Liu, L. Ying, S. Guo, Y. Li, M. Nie, and H. Duan, “Large-scale security measurements on the android firmware ecosystem, ” in ICSE, 2022

    2022

  41. [48]

    Can we trust the phone vendors? comprehensive security measurements on the android firmware ecosystem,

    Q. Hou, W. Diao, Y. Wang, C. Mao, L. Ying, S. Liu, X. Liu, Y. Li, S. Guo, M. Nie et al., “Can we trust the phone vendors? comprehensive security measurements on the android firmware ecosystem, ”TSE, 2023

    2023

  42. [49]

    Physiological signal analysis and classification of stress from virtual reality video game,

    S. Ishaque, A. Rueda, B. Nguyen, N. Khan, and S. Krishnan, “Physiological signal analysis and classification of stress from virtual reality video game, ” in2020 42nd Annual International Conference of the IEEE Engineering in Medicine & Biology Society (EMBC). IEEE, 2020, pp. 867–870

    2020

  43. [50]

    Be- havr: User identification based on vr sensor data,

    I. Jarin, Y. Duan, R. Trimananda, H. Cui, S. Elmalaki, and A. Markopoulou, “Be- havr: User identification based on vr sensor data, ”arXiv preprint arXiv:2308.07304, 2023

    2023 arXiv

  44. [51]

    A brave new world: How to manage safety hazards from augmented reality (ar), virtual reality (vr), and artificial intelligence (ai),

    JDSUPRA, “A brave new world: How to manage safety hazards from augmented reality (ar), virtual reality (vr), and artificial intelligence (ai), ” https://www.jdsupra.com/legalnews/a-brave-new-world-how-to-manage- safety-3563947/

  45. [52]

    {DEFInit}: An analysis of exposed android init routines,

    Y. Ji, M. Elsabagh, R. Johnson, and A. Stavrou, “ {DEFInit}: An analysis of exposed android init routines, ” inUSENIX Security, 2021

    2021

  46. [53]

    Depen- dency facade: The coupling and conflicts between android framework and its customization,

    W. Jin, Y. Dai, J. Zheng, Y. Qu, M. Fan, Z. Huang, D. Huang, and T. Liu, “Depen- dency facade: The coupling and conflicts between android framework and its customization, ” inICSE. IEEE, 2023. 14 A Longitudinal Security Analysis of VR Firmware CCS ’25, October 13–17, 2025, Tai...

    2023

  47. [54]

    What are the security and privacy risks of vr and ar,

    Kaspersky, “What are the security and privacy risks of vr and ar, ” https://usa.kaspersky.com/resource-center/threats/security-and-privacy- risks-of-ar-and-vr

  48. [55]

    Passwalk: Spatial authentication leveraging lateral shift and gaze on mobile headsets,

    A. Kumar, L.-H. Lee, J. Chauhan, X. Su, M. A. Hoque, S. Pirttikangas, S. Tarkoma, and P. Hui, “Passwalk: Spatial authentication leveraging lateral shift and gaze on mobile headsets, ” inACM Multimedia, 2022

    2022

  49. [56]

    {PolyScope}:{Multi-Policy} access control analysis to compute authorized attack operations in android systems,

    Y.-T. Lee, W. Enck, H. Chen, H. Vijayakumar, N. Li, Z. Qian, D. Wang, G. Petracca, and T. Jaeger, “{PolyScope}:{Multi-Policy} access control analysis to compute authorized attack operations in android systems, ” inUSENIX Security, 2021

    2021

  50. [57]

    Kal 𝜀ido: Real-time privacy control for eye-tracking systems,

    J. Li, A. Roy Chowdhury, K. Fawaz, and Y. Kim, “Kal 𝜀ido: Real-time privacy control for eye-tracking systems, ” inUSENIX Security, 2021

    2021

  51. [58]

    Libd: Scalable and precise third-party library detection in android markets,

    M. Li, W. Wang, P. Wang, S. Wang, D. Wu, J. Liu, R. Xue, and W. Huo, “Libd: Scalable and precise third-party library detection in android markets, ” inICSE. IEEE, 2017

    2017

  52. [59]

    Understanding user identification in virtual reality through behavioral biometrics and the effect of body normalization,

    J. Liebers, M. Abdelaziz, L. Mecke, A. Saad, J. Auda, U. Gruenefeld, F. Alt, and S. Schneegass, “Understanding user identification in virtual reality through behavioral biometrics and the effect of body normalization, ” inCHI ’21, 2021

    2021

  53. [60]

    Do customized android frameworks keep pace with android?

    P. Liu, M. Fazzini, J. Grundy, and L. Li, “Do customized android frameworks keep pace with android?” inMSR, 2022

    2022

  54. [61]

    Pico os,

    P. I. P. Ltd., “Pico os, ” https://www.picoxr.com/global/software/pico-os

  55. [62]

    Holologger: Keystroke inference on mixed reality head mounted displays,

    S. Luo, X. Hu, and Z. Yan, “Holologger: Keystroke inference on mixed reality head mounted displays, ” inIEEE VR. IEEE, 2022, pp. 445–454

    2022

  56. [63]

    Eavesdropping on Controller Acoustic Emanation for Keystroke Inference Attack in Virtual Reality,

    S. Luo, A. Nguyen, H. Farooq, K. Sun, and Z. Yan, “Eavesdropping on Controller Acoustic Emanation for Keystroke Inference Attack in Virtual Reality, ” inNDSS, 2024

    2024

  57. [65]

    Post-gdpr threat hunting on android phones: Dissecting os-level safeguards of user-unresettable identifiers

    M. H. Meng, Q. Zhang, G. Xia, Y. Zheng, Y. Zhang, G. Bai, Z. Liu, S. G. Teo, and J. S. Dong, “Post-gdpr threat hunting on android phones: Dissecting os-level safeguards of user-unresettable identifiers. ” inNDSS, 2023

    2023

  58. [66]

    Meta community forums,

    Meta, “Meta community forums, ” https://communityforums.atmeta.com/

  59. [67]

    Meta quest 2: Defense through offense,

    ——, “Meta quest 2: Defense through offense, ” https://engineering.fb.com/2023/ 09/12/security/meta-quest-2-defense-through-offense/

    2023

  60. [68]

    Set up your boundary for meta ques,

    ——, “Set up your boundary for meta ques, ” https://www.meta.com/help/quest/ articles/in-vr-experiences/oculus-features/oculus-guardian/

  61. [69]

    Unlocking oculus go,

    Meta, “Unlocking oculus go, ” https://developers .meta.com/horizon/blog/ unlocking-oculus-go/, 2021

    2021

  62. [70]

    Meta quest 3: Technical specifications,

    Meta Platforms, “Meta quest 3: Technical specifications, ” 2023. [Online]. Available: https://www.meta.com/quest/quest-3/specs/

    2023

  63. [71]

    A keylogging inference attack on air-tapping keyboards in virtual environments,

    Ü. Meteriz-Yıldıran, N. F. Yıldıran, A. Awad, and D. Mohaisen, “A keylogging inference attack on air-tapping keyboards in virtual environments, ” inIEEE VR. IEEE, 2022, pp. 765–774

    2022

  64. [72]

    Combining real-world constraints on user behavior with deep neural networks for virtual reality (vr) biometrics,

    R. Miller, N. K. Banerjee, and S. Banerjee, “Combining real-world constraints on user behavior with deep neural networks for virtual reality (vr) biometrics, ” in IEEE VR. IEEE, 2022

    2022

  65. [73]

    Exploring the unprecedented privacy risks of the metaverse,

    V. Nair, G. M. Garrido, and D. Song, “Exploring the unprecedented privacy risks of the metaverse, ”arXiv preprint arXiv:2207.13176, 2022

    2022 arXiv

  66. [74]

    Deep Motion Masking for Secure, Usable, and Scalable Real-Time Anonymization of Virtual Reality Motion Data,

    V. Nair, W. Guo, J. F. O’Brien, L. Rosenberg, and D. Song, “Deep Motion Masking for Secure, Usable, and Scalable Real-Time Anonymization of Virtual Reality Motion Data, ” Nov. 2023, arXiv:2311.05090 [cs]

    2023 arXiv

  67. [75]

    Going Incognito in the Metaverse: Achieving Theoretically Optimal Privacy-Usability Tradeoffs in VR,

    V. C. Nair, G. Munilla-Garrido, and D. Song, “Going Incognito in the Metaverse: Achieving Theoretically Optimal Privacy-Usability Tradeoffs in VR, ” inUIST. San Francisco CA USA: ACM, Oct. 2023, pp. 1–16

    2023

  68. [76]

    Penetration Vision through Virtual Reality Headsets: Identifying 360-degree Videos from Head Movements,

    A. Nguyen, X. Zhang, and Z. Yan, “Penetration Vision through Virtual Reality Headsets: Identifying 360-degree Videos from Head Movements, ” inUSENIX Security, 2024

    2024

  69. [77]

    Cve-2015-3864,

    NIST-CVE-Database, “Cve-2015-3864, ” https://nvd.nist.gov/vuln/detail/CVE- 2015-3864

    2015

  70. [78]

    Biomove: Biometric user identification from human kinesiological movements for virtual reality systems,

    I. Olade, C. Fleming, and H.-N. Liang, “Biomove: Biometric user identification from human kinesiological movements for virtual reality systems, ”Sensors, 2020

    2020

  71. [79]

    Behavioural biometrics in vr: Identifying people from body motion and relations in virtual reality,

    K. Pfeuffer, M. J. Geiger, S. Prange, L. Mecke, D. Buschek, and F. Alt, “Behavioural biometrics in vr: Identifying people from body motion and relations in virtual reality, ” inCHI ’19, 2019

    2019

  72. [80]

    Trust, but verify: A longitudinal analysis of android oem compliance and customization,

    A. Possemato, S. Aonzo, D. Balzarotti, and Y. Fratantonio, “Trust, but verify: A longitudinal analysis of android oem compliance and customization, ” inS&P (Oakland). IEEE, 2021

    2021

  73. [81]

    Site isolation: Process separation for web sites within the browser,

    C. Reis, A. Moshchuk, and N. Oskov, “Site isolation: Process separation for web sites within the browser, ” inUSENIX Security, 2019, pp. 1661–1678

    2019

  74. [82]

    Meta has sold nearly 20 million quest headsets, but retention struggles remain,

    RoadToVR, “Meta has sold nearly 20 million quest headsets, but retention struggles remain, ” https://www.roadtovr.com/quest-sales-20-million-retention- struggles/

  75. [83]

    Anxiety level recognition for virtual reality therapy system using physiological signals,

    J. Šalkevicius, R. Damaševičius, R. Maskeliunas, and I. Laukien˙e, “Anxiety level recognition for virtual reality therapy system using physiological signals, ”Elec- tronics, 2019

    2019

  76. [84]

    Hardening elf binaries using relocation read-only (relro),

    H. Sidhpurwala, “Hardening elf binaries using relocation read-only (relro), ” https://www.redhat.com/en/blog/hardening-elf-binaries-using-relocation- read-only-relro

  77. [85]

    Enhancing our lives with immersive virtual reality. frontiers in robotics and ai, 3, 74,

    M. Slater and M. V. Sanchez-Vives, “Enhancing our lives with immersive virtual reality. frontiers in robotics and ai, 3, 74, ” 2016

    2016

  78. [86]

    Going through the motions:{AR/VR} keylogging from user head motions,

    C. Slocum, Y. Zhang, N. Abu-Ghazaleh, and J. Chen, “Going through the motions:{AR/VR} keylogging from user head motions, ” inUSENIX Security, 2023

    2023

  79. [87]

    Security enhanced (se) android: bringing flexible mac to android

    S. Smalley and R. Craig, “Security enhanced (se) android: bringing flexible mac to android. ” inNDSS, vol. 310, 2013, pp. 20–38

    2013

  80. [88]

    payload-dumper-go,

    ssut, “payload-dumper-go, ” https://github.com/ssut/payload-dumper-go

  81. [89]

    Virtual reality (vr) - statistics & facts,

    Statista, “Virtual reality (vr) - statistics & facts, ” https://www.statista.com/topics/ 2532/virtual-reality-vr/

  82. [90]

    Remote Keylogging Attacks in Multi-user VR Applications,

    Z. Su, K. Cai, R. Beeler, L. Dresel, A. Garcia, I. Grishchenko, Y. Tian, C. Kruegel, and G. Vigna, “Remote Keylogging Attacks in Multi-user VR Applications, ” May 2024, arXiv:2405.14036 [cs]. [Online]. Available: http://arxiv.org/abs/2405.14036

    2024 arXiv

  83. [91]

    Firmwaredroid: Towards automated static analysis of pre-installed android apps,

    T. Sutter and B. Tellenbach, “Firmwaredroid: Towards automated static analysis of pre-installed android apps, ” in(MOBILESoft). IEEE, 2023

    2023

  84. [92]

    {ATtention} spanned: Comprehensive vulnerability analysis of{AT} commands within the android ecosystem,

    D. J. Tian, G. Hernandez, J. I. Choi, V. Frost, C. Raules, P. Traynor, H. Vijayakumar, L. Harrison, A. Rahmati, M. Graceet al., “{ATtention} spanned: Comprehensive vulnerability analysis of{AT} commands within the android ecosystem, ” in USENIX Security, 2018

    2018

  85. [93]

    You can’t hide behind your headset: User profiling in augmented and virtual reality,

    P. P. Tricomi, F. Nenna, L. Pajola, M. Conti, and L. Gamberini, “You can’t hide behind your headset: User profiling in augmented and virtual reality, ”arXiv preprint arXiv:2209.10849, 2022

    2022 arXiv

  86. [94]

    {OVRseen}: Auditing network traffic and privacy policies in oculus {VR},

    R. Trimananda, H. Le, H. Cui, J. T. Ho, A. Shuba, and A. Markopoulou, “{OVRseen}: Auditing network traffic and privacy policies in oculus {VR}, ” in USENIX Security, 2022, pp. 3789–3806

    2022

  87. [95]

    can’t enabled hand tracking help?

    R. user. (2023) Comment on the post "can’t enabled hand tracking help?". [Online]. Available: https://www.reddit.com/r/MetaQuestVR/comments/ 1ihblz2/comment/mavwlvw/

    2023

  88. [96]

    Surveillance will follow us into the ‘metaverse’, and our bodies could be its new data source,

    T. Verge, “Surveillance will follow us into the ‘metaverse’, and our bodies could be its new data source, ” https://www.washingtonpost.com/technology/2022/01/ 13/privacy-vr-metaverse/

    2022

  89. [97]

    This is meta’s ar / vr hardware roadmap for the next four years,

    ——, “This is meta’s ar / vr hardware roadmap for the next four years, ” https://www.theverge.com/2023/2/28/23619730/meta-vr-oculus-ar-glasses- smartwatch-plans

    2023

  90. [98]

    Union under duress: Under- standing hazards of duplicate resource mismediation in android software supply chain,

    X. Wang, Y. Zhang, X. Wang, Y. Jia, and L. Xing, “Union under duress: Under- standing hazards of duplicate resource mismediation in android software supply chain, ” inUSENIX Security, 2023

    2023

  91. [99]

    The impact of vendor customiza- tions on android security,

    L. Wu, M. Grace, Y. Zhou, C. Wu, and X. Jiang, “The impact of vendor customiza- tions on android security, ” inCCS, 2013

    2013

  92. [100]

    Precise and efficient patch presence test for android applications against code obfuscation,

    Z. Xie, M. Wen, H. Jia, X. Guo, X. Huang, D. Zou, and H. Jin, “Precise and efficient patch presence test for android applications against code obfuscation, ” inISSTA, 2023

    2023

  93. [101]

    Virtual reality security and privacy,

    XRToday, “Virtual reality security and privacy, ” https://www .xrtoday.com/ virtual-reality/virtual-reality-security-and-privacy/

  94. [102]

    Can Virtual Reality Protect Users from Keystroke Inference Attacks?

    Z. Yang, Z. Sarwar, I. Hwang, R. Bhaskar, B. Y. Zhao, and H. Zheng, “Can Virtual Reality Protect Users from Keystroke Inference Attacks?”arXiv preprint arXiv:2310.16191, 2023

    2023 arXiv

  95. [103]

    Sepal: Towards a large-scale analysis of seandroid policy customization,

    D. Yu, G. Yang, G. Meng, X. Gong, X. Zhang, X. Xiang, X. Wang, Y. Jiang, K. Chen, W. Zouet al., “Sepal: Towards a large-scale analysis of seandroid policy customization, ” inWWW, 2021

    2021

  96. [104]

    Building embedded systems like it’s 1996,

    R. Yu, F. Del Nin, Y. Zhang, S. Huang, P. Kaliyar, S. Zakto, M. Conti, G. Portoka- lidis, and J. Xu, “Building embedded systems like it’s 1996, ” inNDSS, 2022

    1996

  97. [105]

    Automated third-party library detection for android applications: Are we there yet?

    X. Zhan, L. Fan, T. Liu, S. Chen, L. Li, H. Wang, Y. Xu, X. Luo, and Y. Liu, “Automated third-party library detection for android applications: Are we there yet?” inASE, 2020

    2020

  98. [106]

    Vpvet: Vetting privacy policies of virtual reality apps,

    Y. Zhan, Y. Meng, L. Zhou, Y. Xiong, X. Zhang, L. Ma, G. Chen, Q. Pei, and H. Zhu, “Vpvet: Vetting privacy policies of virtual reality apps, ” inCCS, 2024, pp. 1746–1760

    2024

  99. [107]

    Practical control flow integrity and randomization for binary executa- bles,

    C. Zhang, T. Wei, Z. Chen, L. Duan, L. Szekeres, S. McCamant, D. Song, and W. Zou, “Practical control flow integrity and randomization for binary executa- bles, ” inS&P (Oakland). IEEE, 2013, pp. 559–573

    2013

  100. [108]

    Precise and accurate patch presence test for binaries,

    H. Zhang and Z. Qian, “Precise and accurate patch presence test for binaries, ” inUSENIX Security, 2018

    2018

  101. [109]

    Libid: reliable identification of obfuscated third-party android libraries,

    J. Zhang, A. R. Beresford, and S. A. Kollmann, “Libid: reliable identification of obfuscated third-party android libraries, ” inISSTA, 2019

    2019

  102. [110]

    It’s all in your head (set): Side-channel attacks on ar/vr systems,

    Y. Zhang, C. Slocum, J. Chen, and N. Abu-Ghazaleh, “It’s all in your head (set): Side-channel attacks on ar/vr systems, ” inUSENIX Security, 2023

    2023

  103. [111]

    An investigation of the android kernel patch ecosystem,

    Z. Zhang, H. Zhang, Z. Qian, and B. Lau, “An investigation of the android kernel patch ecosystem, ” inUSENIX Security, 2021, pp. 3649–3666

    2021

  104. [112]

    The peril of fragmentation: Security hazards in android device driver customizations,

    X. Zhou, Y. Lee, N. Zhang, M. Naveed, and X. Wang, “The peril of fragmentation: Security hazards in android device driver customizations, ” inS&P (Oakland). IEEE, 2014. 15 CCS ’25, October 13–17, 2025, Taipei, Taiwan Vamsi Shankar Simhadri, Yichang Xiong, Habiba Farrukh, and X...

    2014

  105. [113]

    The “Others” category shows consistent growth, increasing from around 1800 to approximately 2600

    Dangerous, Normal, and Signature permissions maintain rela- tively stable values across versions. The “Others” category shows consistent growth, increasing from around 1800 to approximately 2600. Quest Pro.Fig. 16 presents Quest Pro permissions. Dangerous permissions remain st...

  106. [114]

    Vendor specific apps comprise the largest portion with minor fluctuations

    User launchable and Android system apps remain relatively sta- ble. Vendor specific apps comprise the largest portion with minor fluctuations. In Fig. 23, we present permission counts for top-20 APKs across Quest 1 firmware. Several apps consistently show very high permission ...

    2025

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.