Covert Web-to-App Tracking via Localhost on Android

Disclosure: Covert Web-to-App Tracking via Localhost on Android 📢 UPDATE: As of June 3rd 7:45 CEST, Meta/Facebook Pixel script is no longer sending any packets or requests to localhost. The code responsible for sending the _fbp cookie has been almost completely removed. Yandex has also stopped the practice we describe below. We disclose a novel tracking method by Meta and Yandex potentially affec

[dltlt]

Metaピクセルで_fbpクッキーの中身がAndroidのローカルホストに投げられてるから、Yandexなど第三者のアプリもそれらを拾って利用者の識別に使えてしまうと。