Meta Apps Found Misusing Android to Monitor Sensitive Browsing Habits, Say Researchers

Android’s sandboxing technology is designed to prevent apps from sharing sensitive information with one another; however, a loophole has been identified that allows certain applications to circumvent these privacy measures. Recent investigations revealed that Meta and Yandex have embedded tracking code that exploits localhost connections, enabling the unauthorized transmission of cookie data between apps. Both Google and Firefox are currently looking into this issue, which involves the potential violation of terms of service. The legal implications surrounding this tracking practice are still under scrutiny.

Privacy remains a significant concern for users, leading to increased popularity of tools such as VPNs, ad blockers, and private browsing modes. While features like Incognito Mode can mitigate tracking by Internet Service Providers (ISPs), they are not fully effective in preventing apps from sharing sensitive browsing information with third-party marketing servers. The alarming discovery that apps like Facebook can use a loophole to associate anonymized website visits with identifiable users raises serious privacy issues. Researchers have indicated that Meta and Yandex used localhost connections, which are typically unsecured and facilitate internal communications within your device, to bypass Android’s sandboxing security.

In essence, this technique is similar to email tracking methods, which embed unique identifiers in images. However, the localhost tracking method is considerably more complex. It allows apps to detect visited websites that contain scripts like Meta Pixel, widely used for analytics. This exploit can maneuver through multiple channels, and attempts to close these loopholes have been ineffective.

Recent findings suggest that Meta began using this tracking method as early as September 2024, but Yandex may have been exploiting this for over eight years. While neither company provided comments on the matter, representatives from Google and Firefox have confirmed that such actions violate their privacy terms. Notably, just hours after the information broke, the problematic communications related to the Meta Pixel script appeared to cease, with indications that Meta may be attempting to conceal its tracks.