Security Risks of Embedded Browsers in Facebook and Instagram

How Facebook and Instagram’s Embedded Browsers Put Your Privacy at Risk

Facebook and Instagram applications use embedded browsers that automatically open when you click on external links, displaying web pages within the app instead of in a separate browser like Safari or Chrome. This practice, which was highlighted by security researcher Felix Krause, allows Facebook and Instagram to track your online activity on third-party websites, presenting significant privacy risks.

Why Embedded Browsers are Used

Typically, when you click on a link within an app, it opens in a default web browser. However, Facebook and Instagram create a built-in browsing experience by embedding an internal browser to display these sites. While this approach offers a seamless in-app experience, it also allows the apps to run custom JavaScript code on any third-party websites you visit through these browsers. This technique lets the host app observe user interactions such as clicks, scrolls, and even sensitive input like credit card information.

What Information Facebook and Instagram Can Track

When using the in-app browser, Facebook and Instagram gain the ability to monitor a wide range of user interactions, including:

• Passwords entered on login pages,
• Home addresses or other sensitive details filled out in forms,
• Credit card information during online purchases,
• On-screen selections or menus clicked, and
• Text inputs in any form fields.

This capability allows Facebook and Instagram to collect extensive user data, tracking your digital footprint across different websites without requiring your explicit consent.

The Role of JavaScript in Data Collection

Facebook and Instagram achieve this data collection by injecting JavaScript code into the web pages loaded through their embedded browsers. This script can track user interactions on these external sites. Any data entered on a page viewed in the in-app browser can potentially be captured and sent back to Facebook or Instagram, allowing them to collect data about your browsing habits and behavior.

For example, if you click on an ad within Instagram and complete a purchase on the advertiser’s website, Facebook may collect information about that transaction directly through the embedded browser.

Apple’s Response: App Tracking Transparency (ATT)

To protect user privacy, Apple released the App Tracking Transparency (ATT) framework in 2021, requiring iOS apps to request user consent before tracking their data across other apps and websites. This feature, introduced in iOS 14.5, is a critical safeguard against unwanted tracking. With ATT, iOS users must be prompted by apps to allow tracking, giving them greater control over their data.

How ATT Works to Block Data Collection

ATT requires that apps:

1. Request permission from users before tracking them across third-party websites.
2. Offer transparency about the types of data they wish to collect and for what purpose.

If a user declines tracking, iOS restricts the app’s ability to gather data about their activity on other sites, providing users with more control over their privacy.

Despite ATT, however, Facebook and Instagram can still track user interactions within their embedded browsers, as this monitoring occurs directly in the app rather than across external applications. Therefore, while ATT mitigates some privacy concerns, embedded browsers remain a loophole for in-app data collection.

How to Protect Yourself from In-App Browser Tracking

Given the potential privacy risks, here are some steps to safeguard your data when using apps like Facebook and Instagram:

1. Avoid clicking on external links within the app if possible.
2. Copy links and open them in a separate browser like Safari or Chrome.
3. Use iOS settings to manage permissions, opting out of app tracking requests when prompted.
4. Stay informed about how apps collect and use data by regularly reviewing app privacy policies

While ATT has provided a layer of protection against cross-app tracking, users must still be vigilant about data collection practices within in-app browsers. This proactive approach can help limit the data that social media platforms can gather from your interactions.

Editor’s note: This blog was updated November 13, 2024