Protect the Boundary, Not Just the Port

Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost began with a question that looks smaller than its consequences: can a public web page reach a native process on the same phone? The evidence and reasoning across this series answer the more important question: can that reachability join a web identity to a native identity while browser and app isolation still appear to be working? The final judgment is yes for the observed Meta and Yandex deployments, and the durable lesson is that defenses must protect the cross-context relationship—not merely one port, hostname, or protocol.

One relationship, two implementations

The most useful way to read the paper is as an end-to-end model with five roles. A public page or embedded script creates the web-side opportunity. A local interface carries a message between contexts. A native app receives that message. A web-side value is related to a native-side value. An operator’s back end receives or uses the resulting association. The exact code, ports, and protocol can change, but the privacy consequence appears when those roles form a working chain.

Yandex and Meta supplied two different realizations of that chain. Yandex Metrica and the AppMetrica SDK used background localhost HTTP(S) listeners whose settings could be received from Yandex infrastructure. The paper reports a delay of roughly three days before some listeners became active, server-provided port configuration, and a response that combined web-supplied parameters with native identifiers such as the Android Advertising ID and an AppMetrica UUID. The script relayed the result to Yandex’s back end. The implementation’s persistence came from its lifecycle: configuration, waiting, listener activation, local exchange, and cloud-side use.

Meta Pixel used a different carrier. The paper reports that Facebook and Instagram apps listened for local traffic while in the background and that Meta Pixel moved the _fbp cookie through WebRTC-related messages. In the observed STUN stage, SDP munging placed the cookie value in a WebRTC offer field, a local native listener extracted it from the resulting message, and the app forwarded it to Meta in a GraphQL mutation. Meta’s implementation moved from HTTP to WebSocket, then to WebRTC STUN and a later TURN-based variant. The transports changed; the roles did not.

That comparison prevents a misleading conclusion. The problem was not “Yandex used HTTP” or “Meta abused WebRTC.” Those facts matter because they determine what a browser can see and what a mitigation can block. They are implementation choices within a larger relationship. A fixed port rule can interrupt Yandex’s known listener. A browser change that disables one form of SDP modification can interrupt one Meta stage. Neither fact alone guarantees that public web execution cannot create a native identity link through another route.

The relationship also explains why the paper treats the cloud side as essential. The local exchange may last only as long as a page load. The browser-side cookie may later be cleared. The native application may hold an account or device value for longer. Once the operator’s back end receives enough information to interpret the two values as belonging together, the durable privacy consequence can outlive the local request. The central state transition is not merely “a browser contacted localhost.” It is “a transient web value became related to native state in a system capable of retaining and using the association.”

This is also why the paper’s finding does not require a total collapse of sandboxing. A browser can still prevent one web origin from reading another origin’s storage. Android can still prevent an app from opening another app’s private files or reading its memory. The local socket is an exposed interface, not necessarily a hole into private memory. But an interface can be enough to move a value across boundaries that were intended to separate identities. Execution isolation and identity isolation are related goals, not identical guarantees.