Thursday, October 23, 2025

Latest

Meta, Yandex Caught Unmasking Android Users; Meta Claims “Miscommunication”

Meta and Yandex quietly fused Android users’ “anonymous” web histories with their logged-in app identities, researchers say—shredding the sandbox walls that are meant to keep mobile apps and browsers in separate lanes.

A joint team from Radboud University, IMDEA Networks, and KU Leuven discovered that the Meta Pixel and Yandex Metrica analytics scripts—embedded in about 5.8 million and 3 million sites, respectively—silently pass cookies from Chrome, Firefox and other Android browsers to Facebook, Instagram and Yandex apps that are listening on hard-coded localhost ports.

Since September 2024 for Meta and as far back as 2017 for Yandex, the trackers have used a rotating toolkit—HTTP requests, WebSockets and a WebRTC trick called SDP munging—to smuggle the cookies to ports on the same device. The native apps immediately pair those web IDs with the user’s persistent account token and relay the match to backend servers, even in Incognito mode or behind a VPN. 

With Meta Pixel sitting on roughly one-fifth of the web’s top sites and Android commanding 70% of global handset share, the pool of exposed users runs into the billions. Researchers found the Pixel active on 16,000 EU-based sites alone; Yandex performed similar linking on at least 1,300 properties. 

Google called the scheme “a blatant violation of our security and privacy principles” and says Chrome 137 now blocks the specific WebRTC abuse, with broader Android fixes under review. 

Meta said it has “paused the feature” pending talks with Google about a “miscommunication” over Play Store policies, while Yandex asserted the data “does not collect any sensitive information” and that it is discontinuing the practice. 

Brave and DuckDuckGo already blacklist the relevant localhost calls; Chrome’s patch blocks the current SDP variant; Firefox is still “actively investigating.”


Information for this briefing was found via Ars Technica and the sources mentioned. The author has no securities or affiliations related to this organization. Not a recommendation to buy or sell. Always do additional research and consult a professional before purchasing a security. The author holds no licenses.

Video Articles

When 4% of Global Copper Disappears Overnight | David Gower – Emerita Resources

Mining M&A: Gold X2 Acquires Kesselrun Resources

They Said Oil Was Dead. They Were Wrong. | Michael Judson – Record Resources

Recommended

Steadright Enters MOU To Acquire Historic Goundafa Polymetallic Mine In Morocco

Military Seizes Power in Madagascar After President Flees

Related News

Facebook Faces Lawsuit Over Misleading Investors About Negative Effects of Social Media on Mental Health

Facebook, which now goes by the name Meta Platforms (NASDAQ: FB), faces a new lawsuit...

Wednesday, November 17, 2021, 11:19:00 AM

Meta Bets $14B on ‘Superintelligence Labs’ to Outrun OpenAI

Meta Platforms (NASDAQ: META) has collapsed all of its artificial intelligence work into a single...

Tuesday, July 1, 2025, 02:14:00 PM

Meta COO Sheryl Sandberg Steps Down to Focus on Philanthropic Efforts

Longtime Meta Platforms (NASDAQ: FB) COO Sheryl Sandberg has decided to step down from her...

Thursday, June 2, 2022, 12:48:00 PM

Meta’s Policy Changes Prompt High-Profile Lawyer to Quit

Stanford law professor Mark Lemley has quit as Meta‘s (Nasdaq: META) lawyer (or “fired” Meta...

Saturday, January 18, 2025, 03:17:00 PM

Alberta Data Center Plan For Meta Advances With Pembina

Pembina Pipeline (TSX: PPL) is closing on a deal to build a large AI data...

Monday, October 6, 2025, 11:27:00 AM