TikTok's In-App Browser Reportedly Capable of Monitoring Anything You Type

TikTok's custom in-app browser on iOS reportedly injects JavaScript code into external websites that allows TikTok to monitor "all keyboard inputs and taps" while a user is interacting with a given website, according to security researcher Felix Krause, but TikTok has reportedly denied that the code is used for malicious reasons.

tiktok logo
Krause said TikTok's in-app browser "subscribes" to all keyboard inputs while a user interacts with an external website, including any sensitive details like passwords and credit card information, along with every tap on the screen.

"From a technical perspective, this is the equivalent of installing a keylogger on third party websites," wrote Krause, in regards to the JavaScript code that TikTok injects. However, the researcher added that "just because an app injects JavaScript into external websites, doesn't mean the app is doing anything malicious."

In a statement shared with Forbes, a TikTok spokesperson acknowledged the JavaScript code in question, but said it is only used for debugging, troubleshooting, and performance monitoring to ensure an "optimal user experience."

"Like other platforms, we use an in-app browser to provide an optimal user experience, but the Javascript code in question is used only for debugging, troubleshooting and performance monitoring of that experience — like checking how quickly a page loads or whether it crashes," the statement said, according to Forbes.

Krause said users who wish to protect themselves from any potential malicious usage of JavaScript code in in-app browsers should switch to viewing a given link in the platform's default browser if possible, such as Safari on the iPhone and iPad.

"Whenever you open a link from any app, see if the app offers a way to open the currently shown website in your default browser," wrote Krause. "During this analysis, every app besides TikTok offered a way to do this."

Facebook and Instagram are two other apps that insert JavaScript code into external websites loaded in their in-app browsers, giving the apps the ability to track user activity, according to Krause. In a tweet, a spokesperson for Facebook and Instagram parent company Meta said that the company "intentionally developed this code to honor people's App Tracking Transparency (ATT) choices on our platforms."

Krause said he created a simple tool that allows anyone to check if an in-app browser is injecting JavaScript code when rendering a website. The researcher said users simply need to open an app they wish to analyze, share the address InAppBrowser.com somewhere inside the app (such as in a direct message to another person), tap on the link inside the app to open it in the in-app browser, and read the details of the report shown.

Apple did not immediately respond to a request for comment.

Update: A spokesperson for TikTok issued the following statement to MacRumors.

"The report's conclusions about TikTok are incorrect and misleading. The researcher specifically says the JavaScript code does not mean our app is doing anything malicious, and admits they have no way to know what kind of data our in-app browser collects. Contrary to the report's claims, we do not collect keystroke or text inputs through this code, which is solely used for debugging, troubleshooting, and performance monitoring."

According to the TikTok spokesperson, the JavaScript code is part of a software development kit (SDK) that TikTok is leveraging, and the "keypress" and "keydown" functions mentioned by Krause are common inputs that TikTok does not use for keystroke logging.

Tag: TikTok

Popular Stories

New Things Your iPhone Can Do in iOS 18

10 New Things Your iPhone Can Do in iOS 18.2

Thursday October 31, 2024 9:42 am PDT by
Apple is set to release iOS 18.2 in December, bringing the second round of Apple Intelligence features to iPhone 15 Pro and iPhone 16 models. This update brings several major advancements to Apple's AI integration, including completely new image generation tools and a range of Visual Intelligence-based enhancements. There are a handful of new non-AI related feature controls incoming as well. ...
Apple MacBook Pro M4 Cinema 4D Slack Finder Xcode 1

Apple Announces MacBook Pro Models With M4 Pro and M4 Max Chips, Thunderbolt 5 Support, and More

Wednesday October 30, 2024 8:01 am PDT by
Apple today announced new 14-inch and 16-inch MacBook Pro models featuring M4 Pro and M4 Max chips, alongside a new entry-level 14-inch MacBook Pro powered by the M4 chip. Subscribe to the MacRumors YouTube channel for more videos. The new M4 Pro and M4 Max machines come with a minimum of 24GB of Unified Memory as standard, up from 18GB in the previous models. Both models feature three...
M4 Pro on Blue

M4 Pro Chip Benchmark Results Reveal an Extremely Impressive Performance Feat

Thursday October 31, 2024 7:06 pm PDT by
The first Geekbench 6 benchmark results for the M4 Pro chip surfaced today. Impressively, the results that are available so far show that the highest-end M4 Pro chip is faster than the highest-end M2 Ultra chip in terms of peak multi-core CPU performance. Here is a comparison of the results: Mac mini with M4 Pro (14-core CPU): 22,094 multi-core score (average of 11 results) Mac Studio...
m3 macbook air blue

Apple Announces MacBook Air Now Starts With Increased 16GB of RAM With No Price Increase

Wednesday October 30, 2024 8:04 am PDT by
Apple today in its new MacBook Pro press release announced that the MacBook Air lineup now starts with 16GB of RAM, up from 8GB previously. This change applies to the 13-inch model with the M2 chip, the 13-inch model with the M3 chip, and the 15-inch model with the M3 chip. In the U.S., the MacBook Air lineup continues to start at $999, so there is no price increase associated with the...
maxresdefault

Apple Announces Redesigned Mac Mini With M4 and M4 Pro Chips, Two Front USB-C Ports, and More

Tuesday October 29, 2024 8:01 am PDT by
Apple today announced fully redesigned Mac mini models featuring the M4 and M4 Pro chips, a considerably smaller casing, two front-facing USB-C ports, Thunderbolt 5 connectivity, and more. Subscribe to the MacRumors YouTube channel for more videos. The product refresh marks the first time the Mac mini has been redesigned in over a decade. The enclosure now measures just five by five inches...
M4 M4 Pro vs M4 Max Feature

Apple Announcements Recap: M4 iMac, Mac Mini, and MacBook Pro

Wednesday October 30, 2024 9:24 am PDT by
Apple this week made three key Mac product announcements: new iMac, Mac mini, and MacBook Pro models. These machines bring the M4 chip series to Apple's Mac lineup for the first time, but each in its own way offers several new features and changes that go beyond processors. Below, we've compiled a recap of all the highlights. New iMac Apple on Monday announced its latest 24-inch iMac,...
Apple MacBook Pro M4 hero

Skipping the New MacBook Pro? Here Are Two Bigger Changes Rumored

Thursday October 31, 2024 4:00 pm PDT by
While the new MacBook Pro lineup features faster M4 chip options, Thunderbolt 5 support for higher-end configurations, a nano-texture display option, and more, most of the previous MacBook Pro models with Apple silicon chips still offer the latest overall design, and fast performance, which might lead you to avoid upgrading this year. If you are planning to skip the new MacBook Pro, here are ...

Top Rated Comments

sniffies Avatar
29 months ago
TikTok is a tikking bomb that needs to be defused ASAP.
Score: 53 Votes (Like | Disagree)
DHagan4755 Avatar
29 months ago
It's owned by a Chinese company with alleged ties to the CCP. If you're concerned about it, don't use it. It's quite simple.
Score: 52 Votes (Like | Disagree)
bigandtasty Avatar
29 months ago
We were told TikTok was shady and monitoring people almost 2 years ago. Nothing surprising here.
Score: 42 Votes (Like | Disagree)
ian87w Avatar
29 months ago
This is why I hate in-app browser. Let's face it, Google, Facebook, they all do/did it, which is why they're insistence in forcing users to remain in their app with these in-app browser "experience." This is an issue on Android as well, where Google searches on Google app are sticking with Chrome/in-app browser by default even if I have another browser as my default browser.

There are always shenanigans like this. I wish for Apple to simply disable in-app browsers, and force any links to just use the default browser externally.
Score: 40 Votes (Like | Disagree)
macaddict06 Avatar
29 months ago
<shocked pikachu face>
Score: 37 Votes (Like | Disagree)
TheYayAreaLiving ?️ Avatar
29 months ago
I once said, never to trust Facebook. Now I’m going to say, Never trust TikTok.
Score: 24 Votes (Like | Disagree)