I found a bug in visionOS Safari that allows a malicious website to bypass all warnings and forcefully fill your room with an arbitrary number of animated 3D objects... These objects persist in your space even after you exit Safari.
If the victim just views our website in Vision Pro, we can instantly fill their room with hundreds of crawling spiders and screeching bats!
It turns out it was surprisingly easy to find a loophole in the visionOS Spatial Computing permissions model.
The bug doesn't really exist in iOS, it's the intersection of the new spatial computing platform and the old feature that creates the privacy/security violation.
Collection
[
|
...
]