一句话：对179款Android AR应用开展实证与静态分析，揭示敏感数据未披露访问及最小权限违规等隐私风险。
移动AR应用依赖持续摄像头输入和对人脸、周围环境等敏感数据的访问，但现实中是否充分披露并遵循最小权限原则仍不清晰。本文对179款Android AR应用进行实证研究，开发了一种新颖的静态分析技术来检查其数据访问并识别隐私风险，分析聚焦于将虚拟内容与真实实体关联的AR核心组件anchors和trackables。结果发现AR应用常在没有充分披露的情况下访问敏感数据，并通过不受限的SDK API获取超出功能所需的数据，具体识别出58处未披露的面部数据、2D图像和骨骼信息访问，以及82处因过宽数据访问导致的最小权限违规，部分结果经动态插桩确认。文章还指出细粒度访问控制、AR SDK API重设计、自动披露验证和控制/数据流分析等改进方向，并发现754条AR相关路径中存在317条公共调用路径，可用于高效隐私审计与异常检测。
Mobile Augmented Reality (AR) applications have rapidly expanded across domains such as gaming, education, and healthcare. However, AR's reliance on continuous camera input and access to sensitive data, such as faces and the surrounding environment, raises major privacy concerns. Adhering to best privacy practices requires applications to clearly disclose their use of sensitive data and follow the Principle of Least Privilege (PoLP). This paper presents an empirical study of 179 Android AR applications to assess their data access behaviors and evaluate whether these practices are upheld in the real world. To this end, we developed a novel static analysis technique to examine data accesses of these apps and identify potential privacy risks. Our analysis centers on core AR components, namely anchors and trackables, which link virtual content to real-world entities. Our findings revealed that AR apps often access sensitive data without adequate disclosure and frequently access more data than their functionality requires through unrestricted SDK APIs. Notably, our analysis identified 58 instances of undisclosed access to facial data, 2D images, and skeletal information, and 82 instances of PoLP violations through overly broad data access. A subset of these findings was further confirmed through dynamic instrumentation. Furthermore, our analysis suggests that protecting user privacy in AR apps can benefit from fine-grained access control, AR SDK API redesign, automated disclosure verification, and control/data-flow analysis. Particularly, there are 317 common call paths among the 754 AR-related paths we analyzed, suggesting that many AR apps share similar data usage patterns that can be leveraged for efficient privacy auditing and anomaly detection with manageable overhead.
@inproceedings{paperbot12272,
title = {An Empirical Study of Data Access Practice in Android AR Apps to Understand User Privacy Risks},
author = {Sabbir Hussain Meraj and Long Trac and Xiaoyin Wang and Xusheng Xiao and Wei Wang},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834402}
}