How to Block VR/AR Access (WebXR) Globally in Google Chrome

The Spatial Tracking Vector

Google Chrome supports an advanced architecture known as the WebXR Device API. By default, this protocol allows complex web applications (like browser-based 3D games or virtual showrooms) to request direct, low-level access to your connected Virtual Reality (VR) or Augmented Reality (AR) headsets. This grants the browser access to the headset’s internal gyroscopes, accelerometers, and potentially its external tracking cameras to map your physical environment. While useful for immersive web experiences, it is a massive privacy vulnerability. Malicious websites can exploit the WebXR API to silently poll your headset’s sensors, harvesting highly precise biometric movement data or scanning the spatial layout of your private physical room. You must paralyze this API.

How to Block VR/AR Access Globally

You can permanently sever the browser’s ability to interface with your spatial computing hardware via Chrome’s Site Settings.

1. Open the Google Chrome desktop browser.
2. Click the three vertical dots (⋮) in the top right corner and select Settings.
3. In the left-hand sidebar, click on Privacy and security.
4. In the main window, click on Site settings.
5. Scroll down to the “Permissions” heading and click to expand Additional permissions.
6. Click on Virtual reality (or Augmented reality, depending on version).
7. Under the “Default behavior” heading, select the radio button for “Don’t allow sites to use virtual reality devices” (or similar restrictive phrasing).

Total Spatial Isolation

The change takes effect instantly. Google Chrome will completely sever its internal connection to your operating system’s VR/AR hardware enumeration daemon. The browser is now permanently blind to the spatial computing headsets plugged into your machine. If an untrusted website attempts to execute a script to activate your headset’s tracking cameras, the API call will instantly auto-reject in the background, returning a null value. This guarantees absolute spatial isolation, ensuring that unverified web code cannot map your physical environment.