HyTrack: Resurrectable and Persistent Tracking Across Android Apps and the Web

Android apps can freely intermix native and web content using Custom Tabs and Trusted Web Activities. This blurring of the boundary between native and web, however, opens the door to HyTrack, a novel tracking technique. Custom Tabs and Trusted Web Activities have access to the default browser state to enable, e.g., seamless reuse of authentication tokens. HyTrack abuses this shared browser state to track users both in-app and across the web using the same identifier. We present several ways to hide or completely disguise the tracking from the user by integrating it into the app's UI. Depending on the used Android flavor, HyTrack leaves no visible traces at all. Furthermore, by combining basic functionalities of the Android operating system, we also show that identifiers created with HyTrack are almost impossible to get rid of. HyTrack can resurrect tracking identifiers even when users try last-resort techniques, such as changing the default browser or switching devices, making it more persistent than even evercookies were on the Web. While we do not find direct evidence that our technique is already employed, our findings indicate that all essential components are currently in place. A rapid deployment can occur at any given moment. To summarize, this paper provides an early warning of a potentially severe new tracking approach for the Android operating system that solely utilizes the intended behavior of commonly utilized Android features.