How to Block VR/AR Devices (WebXR) Globally in Google Chrome

The Immersive Exploit

Google Chrome supports a highly advanced API known as WebXR. This API allows websites to bypass standard 2D rendering and communicate directly with physical Virtual Reality (VR) and Augmented Reality (AR) headsets plugged into your computer (such as Meta Quests or HTC Vives). While useful for specialized web-based 3D games, it represents a significant hardware privacy vulnerability. Malicious websites can exploit this direct bridge to silently probe your attached hardware, track the physical layout of your room using AR sensors, or attempt to hijack your headset’s cameras. You must completely paralyze this API.

How to Block VR/AR Device Access Globally

You can permanently sever the browser’s ability to see your immersive hardware via Chrome’s Site Settings.

1. Open the Google Chrome desktop browser.
2. Click the three vertical dots (⋮) in the top right corner and select Settings.
3. In the left-hand sidebar, click on Privacy and security.
4. In the main window, click on Site settings.
5. Scroll down to the “Permissions” heading and click to expand Additional permissions.
6. Click on Virtual reality and augmented reality devices.
7. Under the “Default behavior” heading, select the radio button for “Don’t allow sites to use virtual reality and augmented reality devices.”

Hardware Isolation

The change takes effect instantly. Google Chrome will completely sever its internal connection to your operating system’s WebXR driver stack. The browser is now permanently blind to any VR headsets or AR cameras attached to your machine. If a website attempts to execute a WebXR script to scan your spatial environment or project a 3D overlay, the API call will instantly auto-reject in the background, returning a null value. This guarantees absolute physical isolation between the web and your immersive hardware.