A developer named Felix Krause released a tool that reveals what code popular apps are quietly running inside their built-in browsers. The findings are uncomfortable: TikTok was caught monitoring every keyboard tap and screen touch, Instagram was recording text selections, and these are just the apps tested so far.
For product and project leads, the story is less about any single app and more about a class of risk that rarely appears in a sprint plan until it becomes a headline.
What InAppBrowser Found
Krause built InAppBrowser to override common JavaScript functions and report what commands an in-app browser is executing. The process is simple: open the app, use its in-app browser to visit InAppBrowser.com, and receive a code audit. The results from TikTok and Instagram raised immediate concerns.
TikTok's in-app browser intercepted all keyboard inputs and tracked every screen tap during browsing sessions. Instagram went further, recording text selections made on external websites. Neither company disclosed this level of observation in their app store descriptions.
The mechanism is not new. In-app browsers have existed for years as a convenience feature, letting users click links without losing their place in an app. What has changed is the sophistication of what can be injected and collected.
The Technical Reality Check
Krause's tool has limits worth understanding. Apple's iOS 14.3 introduced "Isolated World" mode for JavaScript execution, which prevents websites from verifying what code is actually running. InAppBrowser cannot detect custom gesture recognition, screenshot monitoring, or tracking at the network request level. The tool catches common patterns but not everything an app might be doing.
This means the TikTok and Instagram findings represent a floor, not a ceiling. Other apps could be running additional surveillance that the tool cannot surface. The absence of a flag does not mean clean code.
Who Should Care About This
Product and Engineering Leads
You own the decision to use an in-app browser and the code that runs inside it. If your app opens external links through a web view, you are responsible for whatever that web view observes. Three analytics libraries added over two years can quietly accumulate surveillance capabilities nobody planned. The right question is not "are we doing anything wrong?" but "do we still need everything we are doing?"
Legal and Compliance Teams
You will face questions about data collection whether or not it was intentional. "We did not know" is a difficult position when the data was flowing through infrastructure your team controlled. Privacy regulations increasingly ask what data was collected, why, and how long it was retained. In-app browser behavior is discoverable in a code audit and increasingly discoverable by researchers and regulators.
End Users
They assume that browsing within an app carries the same privacy expectations as browsing in Safari or Chrome. That assumption is often wrong. Users who care about this risk can switch to opening links in their device's default browser, but they first need to know the issue exists.
The Audit That Most Teams Skip
Most product teams have never reviewed their in-app browser's JavaScript injection list. The audit does not require specialized tooling. Start with the web view configuration in your codebase. Document every JavaScript function being overridden and what data each override returns. Cross-reference with your current analytics and advertising SDKs. Remove anything added for features that no longer exist.
The output is usually a list of forgotten instrumentation from shipping cycles past. Cleaning it up takes a day. The alternative is waiting for a researcher's blog post to do it for you, at which point the narrative is not yours to control.
What Comes Next
Apple's "Isolated World" mode is a signal that platform owners recognize the risk. Expect tighter restrictions on what in-app browsers can observe and what apps can inject. Teams that have already documented their in-app behavior will navigate that transition more easily than those scrambling to explain their data flows after a regulator asks.
The broader lesson is structural. Any surface where your app can observe user behavior across third-party content is a privacy surface. Treat it the way you treat cookies, tracking pixels, and SDK integrations. The question is not whether surveillance is happening. The question is whether you know what your app is doing, can explain it, and can justify each piece of it.
Key takeaways
- Felix Krause's InAppBrowser tool exposed hidden JavaScript injection in TikTok and Instagram, revealing monitoring of keyboard inputs, screen taps, and text selections.
- In-app browsers can observe user behavior on external websites, not just render pages.
- The tool has limits: Apple's iOS 14.3 "Isolated World" mode and techniques like custom gesture recognition can evade detection.
- Product teams should audit their in-app browser behavior before external researchers or regulators surface it.
- Teams that document their in-app data flows now will have an easier time navigating future platform restrictions and regulatory requirements.
Frequently asked questions
What is InAppBrowser?
It is a tool built by developer Felix Krause that overrides common JavaScript functions in an in-app browser to report what code is being executed when you visit a webpage through that browser.
What did the tool find in TikTok and Instagram?
Testing found TikTok monitoring all keyboard inputs and screen taps during in-app browsing sessions. Instagram was detected recording text selections made on websites opened through its in-app browser.
Does Apple's iOS 14.3 make in-app browsers safe?
No. Apple introduced "Isolated World" mode, which limits what injected code can observe from a webpage's perspective. However, this does not prevent the host app from running additional tracking code that researchers cannot easily detect.
How can a team audit their own in-app browser?
Review the web view configuration in your codebase, document every JavaScript function being overridden, identify what data each function returns, and remove any instrumentation that is no longer needed.
What is the real risk for product teams?
The risk is twofold: unintentional data collection that creates legal exposure, and reputational damage if external researchers publish findings before your team can explain its practices.