How Android Apps Leak Device Identifiers Across the Native–Web Boundary
Comments on “How Android Apps Leak Device Identifiers Across the Native–Web Boundary”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Researchers built WebViewTracer to show that Android SDKs push device identifiers such as the Advertising ID into WebView JavaScript, where third-party scripts forward them to external servers. In a study of 10,000 Google Play apps, 65% of WebView-using apps injected context-restricted data, mostly through bundled third-party libraries.
Why it ranked
No. 61 of 107 with a score of 0.60. The panel rated it highest on new information (0.91) and substantiated (0.90), lowest on significance (0.65). The claim check took 0.100 off. Placed No. 61, No. 50 by score alone: the 17th Security story of the day (−0.080). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Substantive technical privacy research with detailed traces and a measurement study on Android WebView identifier leakage; well-substantiated and relevant to mobile builders, though a follow-up on a small sample and somewhat narrower in audience.
- AI judgeJudge 3gpt-5.6-luna
- Primary-source research and tooling reveal measurable native-to-WebView privacy leakage at scale, with reproducible instrumentation details and concrete traces. It is highly relevant to Android, SDK, privacy, security, and measurement practitioners; conclusions are mostly supported, though some rhetoric is broad.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.60total under rubric v2.3
- Significance0.65
- Reader interest0.79
- Audience breadth0.67
- Practical relevance0.67
- Substantiated0.90
- Technical depth0.89
- New information0.91
- Counts against: Promotional0.04
- Counts against: Overclaim0.22
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.68 | 0.50 | 0.78 | 0.65 | 0.28 | +0.24 | +0.157 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.72 | 0.72 | 0.94 | 0.79 | 0.22 | +0.26 | +0.206 |
| Audience breadthHow many people who build technology does it concern? | 0.73 | 0.60 | 0.68 | 0.67 | 0.13 | +0.13 | +0.087 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.76 | 0.50 | 0.76 | 0.67 | 0.26 | +0.22 | +0.148 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.98 | 0.80 | 0.92 | 0.90 | 0.18 | +0.05 | +0.045 |
| Technical depthHow technically substantive is it? | 0.96 | 0.80 | 0.91 | 0.89 | 0.17 | +0.05 | +0.045 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.91 | 0.85 | 0.98 | 0.91 | 0.13 | +0.05 | +0.046 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.06 | 0.04 | 0.03 | 0.04 | 0.03 | −0.19 | −0.008 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.24 | 0.25 | 0.18 | 0.22 | 0.07 | −0.11 | −0.025 |
| Sum of contributions | +0.701 | ||||||
| Claim-check penalty | −0.100 | ||||||
| Total, as published | 0.601 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-03/61/"><img src="https://rubric.hrih.si/badge/2026-11-03/61.svg" alt="Ranked #61 on Rubric, 3 Nov 2026" width="238" height="28"></a>Claim check
Claim check: 1 matches source · 1 not in source · 2 no source given · 4 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
In the NDSS 2026 study of 10,000 Google Play apps, 65.0% of apps in which a WebView was observed injected at least one category of context-restricted data.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “So 65.0% of the apps in which we observed a WebView injected at least one category of context-restricted data”
The source says No passage could be compared.
Source cited by the article: ndss-symposium.org/ndss-paper/cross-boundary-mobile-tracking-exploring-java-to-javascript-information-diffusion-in-webviews
Not in sourceNumber
In the study, 96% of observed injections originated in bundled libraries, while only 3.6% came from first-party app logic.
The cited source does not contain it.
The article says “96% of observed injections originated in bundled libraries, while only 3.6% came from first-party app logic”
The source says “We observe that the dynamic properties of WebViews are being actively leveraged for sensitive information diffusion across multiple actors in the mobile tracking ecosystem”
Source cited by the article: ndss-symposium.org/ndss-paper/cross-boundary-mobile-tracking-exploring-java-to-javascript-information-diffusion-in-webviews
Couldn’t checkNumber
In the study, 25 SDKs injected data that scripts sent to 152 external parties.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Overall, 25 SDKs injected data that scripts sent to 152 external parties”
The source says No passage could be compared.
Source cited by the article: ndss-symposium.org/ndss-paper/cross-boundary-mobile-tracking-exploring-java-to-javascript-information-diffusion-in-webviews
Couldn’t checkNumber
Advertising ID was injected in 23.30% and transmitted in 18.19% of the 4,597 WebView-using apps.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Advertising ID 23.30% 18.19% 17.68%”
The source says No passage could be compared.
Source cited by the article: ndss-symposium.org/ndss-paper/cross-boundary-mobile-tracking-exploring-java-to-javascript-information-diffusion-in-webviews
No source givenFirst, only or fastest
The authors' WebViewTracer provides the first system-wide visibility into JavaScript activity inside Android WebViews.
The article gives no link or citation for it.
The article says “To our knowledge, this is the first time anyone has had this level of visibility into system-wide activity inside Android WebViews”
The source says No source to compare with.
No source givenNumber
During a roughly 40-minute Wordscapes session, the Advertising ID appeared in 859 outgoing Web API events.
The article gives no link or citation for it.
The article says “I observed the device’s Advertising ID appearing in 859 outgoing Web API events across numerous advertising and measurement endpoints”
The source says No source to compare with.
Couldn’t checkGeneralization
MX Player's Google Play Data safety section states that no data is shared with third parties, yet version 3.2.5 sent the Advertising ID to Branch and AppsFlyer via InMobi-loaded JavaScript.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “MX Player’s Google Play Data safety section states that no data is shared with third parties”
The source says No passage could be compared.
Source cited by the article: play.google.com/store/apps/datasafety
Matches sourceQuote
Google's Data safety documentation requires developers to account for data transfers performed through third-party SDKs and app-controlled WebViews, subject to certain exceptions.
The cited source says the same thing.
The article says “explicitly requires developers to account for data transfers performed through third-party SDKs and app-controlled WebViews, subject to certain exceptions”
The source says “This includes user data transmitted off device from your app by libraries and/or SDKs used in your app, irrespective of whether data is transmitted to you or a third-party server”
Source cited by the article: support.google.com/googleplay/android-developer/answer/10787469
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 3 Nov 2026, 05:47 UTC. It played no part in the ranking.