This study aims to explore the privacy concerns associated with static hard-coded URLs used by virtual reality (VR) applications. Among these URLs, we identified destinations leading to advertising and analytics services, which may raise user privacy concerns. Our primary focus was in external libraries or sources that developers import, including privacy-related URLs. Through our measurement study of the VR device Oculus Go, we used a proposed categorization methodology to disclose popular advertising and analytics sources. The results revealed the presence of potential privacy threats and their implications for user rights. Consequently, we discuss the possible improvements for VR manufacturers to enhance future VR experiences.