Security researchers have revealed a sophisticated tracking method employed by Meta (Facebook) and Yandex that allowed these companies to covertly link users’ web browsing activity to their mobile app identities, potentially affecting billions of Android users.
The practice, which bypassed standard privacy protections, has been discontinued by Meta as of June 3rd, 2025, following the disclosure.
The tracking mechanism exploited a fundamental feature of Android’s networking architecture through localhost socket communications.
Meta’s Facebook and Instagram apps, along with several Yandex applications including Maps and Browser, silently listened on specific local ports while running in the background.
When users visited websites containing Meta Pixel or Yandex Metrica tracking scripts, these JavaScript codes established connections with the native apps through localhost sockets on the same device.
Meta’s implementation was particularly sophisticated, using WebRTC technology with a technique called SDP Munging to transmit the _fbp cookie from web browsers to Facebook and Instagram apps listening on UDP ports 12580-12585.
The _fbp cookie, present on approximately 25% of the top million websites, typically functions as a first-party cookie that cannot track users across different sites.
However, this localhost method enabled Meta to link different _fbp cookies to the same user account, effectively circumventing privacy expectations and existing protections.
Yandex employed a different approach, with their Metrica script sending HTTP requests to localhost through TCP ports 29009, 29010, 30102, and 30103.
Meta’s New Method
The company’s apps would respond with Base64-encoded payloads containing Android Advertising IDs and other device identifiers, which were then transmitted to Yandex servers by the web-based JavaScript code.
Yandex employed a different approach, with their Metrica script sending HTTP requests to localhost through TCP ports 29009, 29010, 30102, and 30103.
The scope of this tracking practice was extensive, affecting millions of websites globally.
According to the research, Meta Pixel was embedded on over 5.8 million websites, while Yandex Metrica appeared on approximately 3 million sites.
Crawling analysis of the top 100,000 websites revealed that Meta’s localhost tracking was active on 17,223 sites accessed from the US and 15,677 sites from the EU.
Particularly concerning was the practice’s persistence across traditional privacy measures.
The tracking continued to function even when users employed Incognito Mode, cleared their cookies, or were not logged into Facebook or Instagram on their mobile browsers.
This effectively defeated Android’s inter-process isolation and tracking protections based on partitioning and sandboxing.
The method also created additional security risks, as malicious third-party applications could potentially intercept these localhost communications to harvest users’ browsing histories.
Researchers demonstrated this vulnerability with a proof-of-concept app that successfully captured website URLs from browsers including Chrome, Firefox, and Edge.
Industry Response and Current Status
According to Report, Meta has completely ceased this practice, with the Facebook Pixel script no longer sending packets to localhost as of June 3rd, 2025.
Following responsible disclosure to browser vendors, several countermeasures have been implemented or are in development.
Chrome version 137, released on May 26, 2025, included protections to block the abused ports and disable the specific SDP munging technique used by Meta.
Firefox version 139 will include similar countermeasures, while browsers like Brave and DuckDuckGo were already protected through existing blocklists and consent requirements.
Yandex has also discontinued the described tracking method. However, security experts emphasize that addressing this issue comprehensively will require broader platform-level changes, including enhanced user controls and stricter enforcement of Android’s interprocess communication policies.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
 and Yandex.){kind=link}