<\/p>\n
Apple has addressed a significant bug in its Vision Pro system, which previously allowed websites to inundate a user’s environment with countless virtual 3D objects, reported 9To5Mac.<\/p>\n<\/p><\/div>\n
As per the publication, this vulnerability<\/a> was brought to light by a cybersecurity expert who demonstrated the flaw using flying bats as an example. Notably, these virtual objects would persist in the user\u2019s space even after Safari was closed.<\/p>\n Reportedly,\u00a0Apple has implemented stringent security measures to control what can enter a user\u2019s personal space within Vision Pro<\/a>. Typically, native apps operate within a \u201cShared Space” environment, ensuring predictable behavior and easy closure. For a more immersive experience, apps must obtain explicit user permission through an OS-level prompt, granting them access to a \u201cFull Space” context. This permission model also extends to websites, maintaining a high level of security for the user.<\/p>\n The report adds that Apple <\/a>overlooked an augmented reality feature introduced in 2018. This feature, part of WebKit and present in the Vision Pro build, involves the AR Kit Quick Look \u2013 a method for rendering 3D Pixar files using HTML in iOS.\u00a0<\/p>\n This standard supports modern file types like Apple\u2019s .reality format and includes Spatial Audio, enhancing the realism of the 3D objects. These features are enabled by default and do not require user activation of experimental settings.<\/p>\n The critical oversight was that Safari did not enforce any permission model for this feature. Moreover, the feature could be activated through programmatic JavaScript clicking without any user interaction, added the report.\u00a0<\/p>\n Consequently, visiting a malicious website could result in the user\u2019s room being filled with numerous animated and sound-producing 3D objects<\/a> instantly, creating a potentially alarming situation.<\/p>\n The cybersecurity researcher who discovered the vulnerability highlighted this issue, showing how a simple website visit could flood a user\u2019s space with hundreds of spiders or screeching bats. Recognizing the severity of this bug, Apple awarded the researcher an undisclosed amount as a bug bounty and has since resolved the issue, ensuring that Vision Pro users are now protected from such exploits.<\/p>\n \u00a0<\/p>\n \t<\/p>\n