When Shared Worlds Break: Demystifying Defects in Multi-User Extended Reality Systems

Relevant Code

deep_check.py: https://drive.google.com/file/d/10Z7zIPMqWBU3EsVTr8f6P3KwESWjg3Ac/view?usp=drive_link

multi_review_extract.py: https://drive.google.com/file/d/1qdZkgaJWvgJDL_w1w0oz2FWsgAkDBgVn/view?usp=drive_link

README.md: https://drive.google.com/file/d/1u1I8ywW7q8jQHBtRD-FK1_9DsVO53mUw/view?usp=drive_link

Iteration of Symptoms and Root Causes Taxonomy 

Section 6 Reorgreorganization

Existing research on XR software quality has primarily focused on single-user experiences, security vulnerabilities, or high-level design challenges. In this section, we position our work against these studies to highlight the unique contributions of our multi-user defect taxonomy.

6.1 Defect Analysis: Single-User vs. Multi-User XR While empirical studies on software defects are common in mobile [69] and web domains [61], research specifically targeting XR defects is nascent and predominantly focused on single-user contexts. Li et al. [56] conducted the most relevant prior work by modeling the software quality of WebVR applications based on user reviews. They classified issues into 12 categories, such as "Hardware & Device" and "Application Runtime".

However, their taxonomy reflects the nature of single-user consumption, where defects are largely isolated to local rendering or browser compatibility. In contrast, our study reveals that multi-user XR introduces an entirely new dimension of defects that single-user taxonomies fail to capture. Specifically, our findings show that 18.04% of bugs (S1) relate to State & Synchronization Inconsistency—a category non-existent in single-user studies like [56]. Furthermore, while Li et al. identified general "Interaction" issues, our taxonomy differentiates between local interaction failures and Interaction & Control Discrepancies (S2) caused by distributed state conflicts, such as race conditions in object ownership. Our work bridges this gap by offering the first taxonomy explicitly designed to categorize the complexity of shared, distributed XR environments.

6.2 Security Vulnerabilities vs. Functional Reliability The intersection of XR and data privacy has attracted significant attention. Guo et al. [54] performed a comprehensive empirical study on security vulnerabilities and data leaks in VR applications, identifying risks such as unauthorized data access. Similarly, Miller et al. [58] and Adams et al. [45] investigated the identifiability of user tracking data and general privacy perceptions, respectively.

While we draw methodological inspiration from Guo et al. [54]—specifically their keyword-based filtering approach for identifying relevant reports—our work differs fundamentally in scope and intent. Guo et al. focused on security vulnerabilities (exploitable flaws often inviting malicious attacks) and used a dataset of verified security threats. In contrast, our study targets functional software defects (unintentional bugs in logic, state management, or implementation). There is no overlap between our dataset and that of [54]. Crucially, our analysis in RQ4 extends the state of the art by demonstrating how non-malicious functional bugs (e.g., synchronization errors or audio leaks) can inadvertently lead to severe privacy violations and health risks, a perspective distinct from the threat-modeling approach of prior security studies.

6.3 From High-Level Challenges to Concrete Root Causes Prior literature has extensively documented the high-level challenges of designing multi-user XR. Xanthidou et al. [68] and Tümler et al. [66] identified spatial coordination and consistency as primary hurdles in collaborative VR. From a performance perspective, Nusrat et al. [60] analyzed commit histories to show that developers struggle significantly with optimization in Unity-based projects.

Our work complements these studies by moving from high-level challenges to concrete root causes. While [68] identifies "spatial design" as a challenge, our findings explain why it fails technically: often due to Defective State Synchronization Algorithms (RC1.1) or Avatar State Desynchronization. Similarly, while [60] highlights the need for optimization, our correlation analysis connects specific performance defects (e.g., frame skips) directly to physical health implications (cybersickness) in multi-user settings. By mapping these high-level design constraints to specific software defects (e.g., RC2.3 Join/Leave handling), our taxonomy provides the actionable engineering feedback loop that previous design-centric studies lacked.