Hacker News Reader

Comment by ThinkBeat | Hacker News Reader

I dont yet understand this attack.

The WP article says:

"" Millions of websites contain a string of computer code from Meta that compiles your web activity. It might capture the income you report to the government, your application for a student loan and your online shopping. ""

If I read that correctly then they are capturing all https web content you access in clear text and uploads it all to Meta? Then Meta

I thought the exploit was used to track where you visited, not the full data of each webpage.

View on HN

It does sound fantastical. A piece of code that can violate the same origin policy would be a huge vulnerability. Meta could be working with other sites to share data on users via code running on both sites, but snooping on tax data without the IRS helping? Unlikely.

I can only assume they're suggesting that companies like Intuit and H&R Block are sharing this data with Meta, but that seems like a huge violation of privacy and with tax data it might even be illegal.

It's effectively malware—this article has some more detail: https://arstechnica.com/security/2025/06/meta-and-yandex-are...

Basically, they created a channel between the browser and a localhost webserver running in their native apps, by abusing the ability to set arbitrary metadata on WebRTC connections. That way, they were able to exfiltrate tracking cookies out of the browser's sandbox to the native app, where they could be associated with your logged-in user identity.

Is there any way to fix it within Android? damn...

Yes, don't install their native apps.

that's great but cheaper android phones come with built-in Meta apps/services which cant even be uninstalled.

You can still disable them and I think also uninstall with adb.

You are implying Meta and others were able to just siphon data from any website via WebRTC using their native apps, but this was not the case. They were only able to track which websites you visited if that website already embedded the company tracking. Many websites do, but not all.

Reply on news.ycombinator.com