Covert Web-to-App Tracking via Localhost on Android: Meta and Yandex Caught

Researchers have uncovered a novel tracking method employed by Meta and Yandex, potentially impacting billions of Android users. Native apps like Facebook, Instagram, and several Yandex apps silently listen on localhost ports, receiving browser metadata and cookies from Meta Pixel and Yandex Metrica scripts embedded on websites. This allows linking browsing sessions to user identities, bypassing privacy measures. Meta has since updated its Pixel script (as of June 3rd) to stop sending data to localhost.