Meta and Yandex are de-anonymizing Android users’ web browsing identifiers

Tracking code from Meta and Russia-based Yandex is de-anonymizing Android users by abusing legitimate browser-to-app communication protocols, according to researchers, and Google says it is investigating. The Meta Pixel and Yandex Metrica trackers are estimated to be installed on 5.8 million and 3 million sites, respectively, and the bypass lets the companies pass cookies or identifiers from Chromium-based browsers and Firefox to the Facebook, Instagram, and Yandex Android apps, linking browsing history to logged-in accounts. Meta said it paused the feature while it works with Google, and Yandex said it is discontinuing the practice. Browsers including DuckDuckGo, Brave and Vivaldi have blocked or mitigated the leakage, but the researchers caution these fixes could become ineffective.