Open your phone's browser in private mode and a comforting assumption kicks in. This window is sealed off. Whatever you read here can't be tied to the name on your social accounts. For years that assumption held up reasonably well — browsers and phones are built around "sandboxing," the principle that one app shouldn't be able to peer into another.
Then, in mid-2025, a team of academic researchers pulled that assumption apart. They documented a tracking method that quietly punched a hole straight through the sandbox, letting a website talk directly to the apps already installed on your phone. The browser thought it was alone. It wasn't. Below, we'll walk through exactly how the trick worked, what it could and couldn't see, why the usual defenses did nothing to stop it, and where things stand now that it's been exposed.
What the researchers actually found
The discovery came from a peer-reviewed study titled Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost, produced by researchers at IMDEA Networks, Radboud University, and KU Leuven, and accepted to the USENIX Security Symposium. They examined two of the most widespread tracking scripts on the internet — Meta Pixel and Yandex Metrica — and found both abusing the same overlooked corner of Android.
That corner is localhost: the loopback address 127.0.0.1 that a device uses to talk only to itself. It exists for legitimate reasons — developer testing, internal app communication, media connections. The problem is access control. On Android, any installed app holding the basic INTERNET permission can quietly open a listening socket on this loopback interface, and browsers on the same device can reach that interface without asking you or even notifying you.
Here is the mechanism in plain terms. When you opened a website carrying one of these scripts, the JavaScript reached out to specific, fixed local ports on your own phone. A native app — sitting in the background — was already listening on those exact ports. The two shook hands internally, and a wall that was supposed to be solid became a doorway.
The port details differ by company, and they matter. Meta Pixel used TCP ports 12387 and 12388, plus a UDP port in the range 12580–12585, leaning on WebRTC — first STUN requests built through a hack called SDP munging, later switching to TURN after browser makers began blocking the STUN method. Yandex Metrica had been at this far longer: it sent HTTP requests to TCP ports 29009 and 30102 starting in 2017, then added HTTPS delivery over ports 29010 and 30103 in 2018. Both methods were still active when the research went public.
Bridging the gap to your real identity
A reasonable question at this point: why would a website want to whisper to an app on your phone? The answer is the entire purpose of the exploit — turning an anonymous web visit into a named person.
Consider how Meta's version worked end to end. The Meta Pixel script grabbed the _fbp cookie from your browser. That cookie is a first-party identifier, meaning it's normally siloed to a single website and can't, by design, follow you across the web. The script then passed that _fbp value through the localhost channel to the Facebook or Instagram app running in the background — provided you were logged in. The app, holding your permanent account identity, forwarded the cookie to Meta's GraphQL endpoint, stitching the web visit directly to your real, logged-in profile.
That's the quiet violation. A cookie meant to stay anonymous and site-specific suddenly carried your name. Different _fbp cookies from different websites could all be reconciled to the same individual.
Yandex ran the bridge in reverse. Its native apps — Maps, Navigator, Search, Browser — listened on their ports and, when pinged, handed the Android Advertising ID and other device identifiers back to the Yandex Metrica script in the browser. The script then bundled those identifiers off to Yandex servers. In that flavor, the app acted as a supplier of hardware-level IDs that the website itself was never supposed to reach.
"The bridge isn't built in the cloud — it's built on your own machine, port by port."
How widespread this was
This wasn't a fringe experiment confined to a handful of shady sites. Meta Pixel is embedded on roughly 5.8 million websites, making the _fbp cookie one of the most common first-party cookies on the entire web. In a controlled crawl of the top 100,000 sites, researchers observed Meta Pixel attempting the localhost handoff on 17,223 sites accessed from the US. And the consent picture was bleak: more than 75% of affected sites triggered the tracking before any consent was given — or offered no consent form at all. For a large majority of visits, in other words, the bridge was being built the moment the page loaded, regardless of what you clicked.
Why incognito mode and VPNs gave you nothing
This is the part that unsettles most people, because it dismantles the defenses they trust.
A VPN protects data in transit across the internet. But the localhost exchange never touched the internet. It happened entirely inside your device — browser to app, over the loopback interface. There was no outbound connection for a VPN to encrypt, reroute, or hide. The traffic stayed home.
Incognito mode fared no better. Because the identity link was forged in real time by the listening app — not stored as a persistent third-party cookie in your browser — wiping your history after the fact accomplished nothing. The handoff had already happened. The researchers confirmed the technique still functioned across every situation people assume keeps them anonymous:
Not logged in
The technique still worked even when you weren't logged in through the mobile browser — the listening app supplied the identity the browser session lacked.
Private mode
Browsing in private or incognito mode changed nothing. The handoff happened live, in the active session, before any state was discarded.
Cleared data
Even with cookies and browsing data cleared, the bridge had already done its work. As the researchers put it, the method defeated Android's process isolation and the partitioning, sandboxing, and state-clearing protections browsers rely on.
To a conventional privacy tool or a default browser setting, none of this looks like an attack. The script loaded from the site you chose to visit and talked to an interface that exists for legitimate reasons. Nothing about it trips the alarms built for external tracking, so the loopback handshake sails through, classified as ordinary device behavior rather than the surveillance it is.
Where things stand after disclosure
It's important to be precise here, because the story has a genuine turning point rather than an open-ended threat.
The researchers practiced responsible disclosure, and the response was swift. On or around June 3, 2025, the Meta Pixel script stopped sending packets to localhost; the code responsible for transmitting the _fbp cookie was almost entirely removed. Yandex also halted the practice. Meta, for its part, said it had "decided to pause the feature" while it worked through what it called a potential miscommunication over policy with Google.
Browser makers moved too. Chrome 137 shipped countermeasures blocking the abused ports and the specific SDP munging Meta had used, covering both the STUN and later TURN variants. Firefox prepared its own fixes, and DuckDuckGo patched gaps in its blocklist. Brave was largely unaffected from the start — it has required user consent for localhost requests since 2022 and blocks calls to 127.0.0.1 outright. Google called the behavior a blatant violation of its Play marketplace terms and opened an investigation.
So the immediate bleeding has been stopped. That's the honest, current status — not a live emergency, but a vivid demonstration of what the architecture permits.
Why the underlying risk hasn't gone away
Here's the catch, and the researchers were blunt about it. The fixes that worked are mostly blocklist-based — they target the specific ports and hostnames Meta and Yandex happened to use.
That makes them inherently fragile. As one of the researchers, Narseo Vallina-Rodriguez, warned, any browser relying on blocklisting "will likely enter into a constant arms race." A tracker can switch to a different port number or rotate through ephemeral hostnames and slip past defenses tuned to yesterday's behavior. Blocklists patch the symptom, not the disease.
The disease is structural: on Android, access to localhost sockets is essentially uncontrolled, with no way for a user to see or stop this kind of internal communication. A durable fix requires platform-level change — proper permissions, user notifications, or stricter enforcement around how apps and browsers use loopback channels. Until that lands, the door that Meta and Yandex walked through remains, technically, a door. That residual exposure is the real reason this case deserves attention going forward.
Where script-level blocking fits
If blocklists at the port level are an arms race, there's a more upstream place to intervene: stopping the tracking script from running in the first place. This is the angle the Total Adblock App takes. Both halves of the exploit — Meta's and Yandex's — depended entirely on their tracking JavaScript executing in your browser. No Meta Pixel, no _fbp handoff. No Yandex Metrica script, no request to wake the listening app. The localhost bridge only gets built if the script on the page is allowed to load and run.
If the script never loads, it never reaches toward those local ports.
If it never reaches the ports, the listening app is never woken.
If the app is never woken, there's no handoff to link the visit to your name.
By intercepting and blocking known tracking pixels and analytics scripts at the network level — before they execute — Total Adblock removes the component that initiates the connection. The browser never reaches toward those local ports, because the code that would have told it to never runs. Rather than chasing each new port or hostname after the fact, this severs the pipeline at its source: the script itself. It's a complementary layer, not a silver bullet — platform-level reform is still the proper long-term answer. But blocking the trigger is a meaningful, here-and-now way to keep your browsing on one side of the wall and your app identity on the other. A sealed sandbox was supposed to mean your web activity and your real identity stayed strangers; blocking tracking scripts before they ever execute keeps that bridge from being built at all — no script, no handoff, no link to your name.
