Disclosure: Covert Web-to-App Tracking via Localhost on Android 📢 UPDATE: As of June 3rd 7:45 CEST, Meta/Facebook Pixel script is no longer sending any packets or requests to localhost. The code responsible for sending the _fbp cookie has been almost completely removed. Yandex has also stopped the practice we describe below. We disclose a novel tracking method by Meta and Yandex potentially affec