Localhost tracking
2025-06-11 20:31:15.724912+02 by Dan Lyke 0 comments
Disclosure: Covert Web-to-App Tracking via Localhost on Android. If you're familiar with peer discovery protocols....
On or around May 17th, Meta Pixel added a new method to their script that sends the _fbp cookie using WebRTC TURN instead of STUN. The new TURN method avoids SDP Munging, which Chrome developers publicly announced to disable following our disclosure. As of June 2, 2025, we have not observed the Facebook or Instagram applications actively listening on these new ports.
“Localhost tracking” explained. It could cost Meta 32 billion. (Let's fucking hope.)