Researchers found that Meta and Yandex used a localhost loophole in Android to secretly track users’ web activity, including during Incognito Mode and with VPNs enabled. The exploit bypassed sandboxing protections and let apps monitor visits to websites with Meta Pixel installed without user consent. After the discovery was reported, the tracking behavior and related code vanished. Mozilla and Google are investigating, but experts say only platform-level changes can fully prevent this type of surveillance.
