Meta and Yandex Android Localhost Tracking: What Research Found

In 2025, independent researchers disclosed a web-to-app tracking technique on Android in which website scripts associated with Meta Pixel and Yandex Metrica communicated through localhost with the companies’ installed apps. The finding matters because it linked web identifiers to app identity through a channel users and website operators were unlikely to expect.

What the researchers observed

The LocalMess research project describes browser scripts sending identifiers through localhost ports to installed Android applications, allowing the app context to associate web activity with logged-in identity. The project covers Meta Pixel and Yandex Metrica implementations and documents testing, disclosure, and updates.

What the finding does and does not establish

The research establishes the described behavior in the tested period, sites, scripts, apps, browsers, and Android conditions. It does not establish that every website visitor was affected, that every analytics product behaved the same way, or that the stopped implementation remains active. The research team says a peer-reviewed paper is scheduled for USENIX Security 2026.

What changed after disclosure

The project timeline states that Meta stopped sending the relevant packets or requests to localhost on June 3, 2025 and that Yandex also stopped the described practice. Platform vendors and browsers may add further restrictions. Any renewed conclusion should be based on current testing and current platform documentation, not the original headline alone.

What organizations should review

• Third-party scripts and tags present on public pages.
• Contract, privacy notice, and consent representations.
• Information flows beyond the visible website request.
• Mobile application permissions and embedded SDKs.
• Change monitoring for analytics code and vendor terms.
• A response path for researcher and user reports.

Platform direction

The Android Developers Blog’s Android 17 guidance describes the ACCESS_LOCAL_NETWORK permission and privacy-preserving alternatives for local network access. Website operators should not assume platform controls replace their own script inventory, vendor review, consent, minimization, and verification responsibilities.

Next step for your environment

Inventory public-site analytics and mobile SDKs, verify the current information flow, and reconcile it with contracts, consent, privacy notices, and current platform controls.

Record the accountable owner, baseline, source date, decision, exceptions, acceptance evidence, and review trigger. Test consequential changes in a bounded environment, maintain a rollback path, and verify the real result before closing the work. Product names, availability, pricing, legal requirements, and security guidance can change; recheck the primary sources whenever the decision is renewed or the environment changes.

If you need an independent baseline before changing production systems, start with an ITECS technology and security assessment and keep the resulting evidence with the decision record.

Sources and update trigger

• LocalMess — Covert Web-to-App Tracking via Localhost on Android
• LocalMess — Research paper
• Android Developers Blog — Android 17 local-network access

Review trigger: Review after peer review, new testing, vendor response, browser behavior, Android permission, analytics-script, or privacy-policy changes.