ethereal I guess after this incident, Google will (at last) close this loopback hole, that makes IPC possible even between different user profiles.
What we might hope for is that they make each app have their own loopback interface, or that they enforce similar barriers using firewall rules. Android already offers a mean for IPC communication, no one is supposed to use loopback for this.
But I got the feeling they were more favorable to the idea of just forcing Yandex and Meta to stop doing this in their apps, or be banned from Google Play. So we shouldn't hope too much.
ethereal If you don't use VPNs, the browser and the app will be sharing the IP address for their Internet connection. This IP could be used exclusively by you, so it would be trivial for an adversary to link your browsing activity with the account that you've set up on the app.
This is a well-known issue though, with a well-known solution, just use a separate VPN per user profile, that do not share exit IP address.
natoal Is that an attack? That's basic tracking
Web sites are not supposed to be able to communicate with installed apps on your device in any way at all. So it is a vulnerability, it is breaking the expected protections the web browser should offer.