InAppBrowser.com - a new tool I used to investigate the in-app browsers of apps (that use them) to look for any external JavaScript code being injected.
When opening a website from within the TikTok iOS app, they inject code that can observe every keyboard input (which may include credit card details, passwords or other sensitive information) TikTok also has code to observe all taps, like clicking on any buttons or links.
Continuing to analyse the Instagram iOS app, I found something new: Besides injecting pcm.js (as covered last week), Instagram also injects JavaScript code to observe all taps happening inside their in-app browser, like clicking on buttons, links or images.
As of iOS 14.3, apps can easily hide their JavaScript activities from websites using WKContentWorld. Hence, it becomes more important than ever to find a solution to end the use of custom in-app browsers for showing third party content.
Apps that use the recommended SFSafariViewController approach, don’t have any of those problems. Even with the WKContentWorld system, there is no way the iOS app can inject JS code into external websites, making it the safest choice for the user.
