What is localhost tracking (the "Local Mess" vulnerability)?

The discovery: how Meta bridged browser and app worlds

Localhost tracking abuses the loopback network interface to connect the browser sandbox with native apps. Online privacy relies on boundaries: Android isolates websites inside the browser and keeps them away from apps. Localhost tracking, which researchers named "Local Mess", turned these assumptions upside down.

Researchers from IMDEA Networks, Radboud University and KU Leuven disclosed it in June 2025. They found that Meta used the technique on Android from September 2024, and Yandex since 2017. When a user visited a website with the Meta Pixel, the script did more than track page views. It contacted local ports where Meta apps listened in the background. A loopback interface designed for developer testing became a covert channel for cross-platform tracking, past the browser's sandbox.

How the technical mechanics of the bypass work

Step 1: The Android native app as a background socket listener

The bypass relies on three synchronised steps. First, Meta's Android apps (Facebook and Instagram) opened local listeners in the background, on UDP ports 12580–12585 (and TCP 12387 and 12388). Yandex apps, such as Maps, Navigator, Browser and Search, listened on TCP ports 29009, 29010, 30102 and 30103.

Step 2: The Meta Pixel initiates a local loopback request

Second, the user visits a site with the Meta Pixel in a mobile browser. Browsers allowed scripts to send requests to 127.0.0.1 without warnings. The Meta Pixel first used HTTP requests and, from November 2024, WebRTC: it placed the _fbp cookie value inside a STUN message through "SDP munging" and sent it to the local UDP ports. In May 2025 it added a TURN-based variant. Yandex Metrica used HTTP and HTTPS requests to its local ports.

Step 3: De-anonymization and session merging

Finally, the listening app links the web visit to a real identity. Meta's apps received the _fbp cookie and sent it to Meta's servers together with the logged-in app user; the Pixel also sent the same _fbp value from the browser. Yandex's apps answered the browser with data including the Android Advertising ID, which the script uploaded to Yandex. Every page visit or form submission on that website can be tied to the user's app profile.

Why traditional privacy measures (VPNs, incognito, cookies) failed

Why VPNs do not encrypt or block loopback traffic (127.0.0.1)

A VPN only handles traffic that leaves your phone. VPNs work at the routing level and encrypt outgoing traffic to the public internet. Loopback traffic to 127.0.0.1 never leaves the device, so the VPN ignores it and the local connection proceeds unhindered. It also differs from a WebRTC leak, where WebRTC exposes your real IP address to a website: here WebRTC carried an identifier to a local app.

Why incognito mode and clearing cookies offered zero protection

Private browsing deletes cookies when the session ends, but it does not stop tracking scripts while the session runs. The researchers confirmed the method worked in incognito mode and after clearing cookies: the Pixel simply sent the fresh _fbp value to the app, and the app supplied the identity. Classic defences against cookies or canvas-based identifiers, explained in our browser fingerprinting explained guide, therefore did not help. The link happened in real time.

Legal fallout and the €32 billion GDPR liability claim

Rose v. Meta: the Android localhost class action

In the United States, Devin Rose and other Android users filed a proposed class action in federal court in Northern California in June 2025. They argue that Meta's loopback tracking violated a California wiretapping law and was a "highly offensive" intrusion upon seclusion; Google is sued for negligence as Android's designer. In May 2026 Judge Rita Lin let most claims proceed. These are allegations, not findings.

What is behind the €32 billion figure?

In Europe, the technique raises questions under the GDPR, because it tracked users without clear consent. Jorge García Herrero of the Zero Party Data newsletter estimated a "combined theoretical maximum risk" of about €32 billion by adding maximum fines under the GDPR, the Digital Services Act and the Digital Markets Act. This is a ceiling, not a fine any regulator has issued.

Industry remediation: patches, Local Network Access and browser protections

Local Network Access (LNA) and port blocking

Browser vendors reacted quickly. Chrome 137 blocked the abused ports and the SDP munging trick, and Firefox 139 blocks the ports. Meta's script stopped sending data to localhost on 3 June 2025, and Yandex also stopped.

The lasting fix is Local Network Access, a WICG specification. It requires public websites to get permission before they send requests to local addresses, including 127.0.0.1. Chrome launches its permission prompt in Chrome 142; WebRTC was not yet covered at first.

Privacy-first browsers already had defences. Brave has required permission for localhost requests since version 1.54 (2023) and was not affected; DuckDuckGo updated its blocklist. To see how browsers compare, read our privacy browser comparison. What a website sees from your requests is a separate layer, covered in our http headers fingerprint guide.

Practical steps to protect your device against loopback tracking

Use privacy-focused browsing and keep it updated

  • Update your browser. Current Chrome and Firefox versions block the ports used here.
  • Use a browser that blocks local requests by default, such as Brave. Tor Browser adds further isolation; see our tor browser privacy guide. The researchers did not test Tor Browser, so treat this as an extra layer.
  • Block tracking scripts. A content blocker or DNS filter that stops the Meta Pixel from loading also stops the local request.

Restrict background app activity or use mobile web apps

Limit what native apps do in the background. On Android, open the app settings and restrict "Background activity" for apps like Facebook and Instagram. Deleting the native apps and using the mobile web versions removes the local listener completely and breaks this web-to-app link.

Can SpeedIQ detect localhost tracking?

No. The SpeedIQ privacy check runs in your browser and does not scan local ports. It shows your IP, DNS provider, WebRTC, IPv6 and fingerprint values, and the results stay in your browser. Run the SpeedIQ test for these checks, and see the online privacy check guide for the full picture.

FAQ

What is localhost tracking?

It is a web-to-app tracking method: a website script sends data to an app on the same device through the loopback address 127.0.0.1, so the app can link the web visit to a logged-in user.

Does a VPN protect against localhost tracking?

No. Loopback traffic never leaves the device, so the VPN does not see or block it.

Is Meta still using localhost tracking?

The researchers reported that the Meta Pixel stopped sending data to localhost on 3 June 2025, and Yandex also stopped.

Which browsers block localhost tracking?

Brave asks for permission before sites reach localhost. Chrome 137 and Firefox 139 block the abused ports, and Chrome adds a Local Network Access prompt.

Sources