TikTok's In-App Browser Reportedly Capable of Monitoring Anything You Type

TikTok's custom in-app browser on iOS reportedly injects JavaScript code into external websites that allows TikTok to monitor "all keyboard inputs and taps" while a user is interacting with a given website, according to security researcher Felix Krause, but TikTok has reportedly denied that the code is used for malicious reasons.

tiktok logo
Krause said TikTok's in-app browser "subscribes" to all keyboard inputs while a user interacts with an external website, including any sensitive details like passwords and credit card information, along with every tap on the screen.

"From a technical perspective, this is the equivalent of installing a keylogger on third party websites," wrote Krause, in regards to the JavaScript code that TikTok injects. However, the researcher added that "just because an app injects JavaScript into external websites, doesn't mean the app is doing anything malicious."

In a statement shared with Forbes, a TikTok spokesperson acknowledged the JavaScript code in question, but said it is only used for debugging, troubleshooting, and performance monitoring to ensure an "optimal user experience."

"Like other platforms, we use an in-app browser to provide an optimal user experience, but the Javascript code in question is used only for debugging, troubleshooting and performance monitoring of that experience — like checking how quickly a page loads or whether it crashes," the statement said, according to Forbes.

Krause said users who wish to protect themselves from any potential malicious usage of JavaScript code in in-app browsers should switch to viewing a given link in the platform's default browser if possible, such as Safari on the iPhone and iPad.

"Whenever you open a link from any app, see if the app offers a way to open the currently shown website in your default browser," wrote Krause. "During this analysis, every app besides TikTok offered a way to do this."

Facebook and Instagram are two other apps that insert JavaScript code into external websites loaded in their in-app browsers, giving the apps the ability to track user activity, according to Krause. In a tweet, a spokesperson for Facebook and Instagram parent company Meta said that the company "intentionally developed this code to honor people's App Tracking Transparency (ATT) choices on our platforms."

Krause said he created a simple tool that allows anyone to check if an in-app browser is injecting JavaScript code when rendering a website. The researcher said users simply need to open an app they wish to analyze, share the address InAppBrowser.com somewhere inside the app (such as in a direct message to another person), tap on the link inside the app to open it in the in-app browser, and read the details of the report shown.

Apple did not immediately respond to a request for comment.

Update: A spokesperson for TikTok issued the following statement to MacRumors.

"The report's conclusions about TikTok are incorrect and misleading. The researcher specifically says the JavaScript code does not mean our app is doing anything malicious, and admits they have no way to know what kind of data our in-app browser collects. Contrary to the report's claims, we do not collect keystroke or text inputs through this code, which is solely used for debugging, troubleshooting, and performance monitoring."

According to the TikTok spokesperson, the JavaScript code is part of a software development kit (SDK) that TikTok is leveraging, and the "keypress" and "keydown" functions mentioned by Krause are common inputs that TikTok does not use for keystroke logging.

Tag: TikTok

Popular Stories

iPhone 17 Pro Dual Tone Feature 1

iPhone 17 Pro Launching Later This Year With These 8 New Features

Thursday January 9, 2025 5:45 am PST by
While the iPhone 17 Pro and iPhone 17 Pro Max are not expected to launch until September, there are already plenty of rumors about the devices. iPhone 17 Pro concept based on rumors Below, we recap key changes rumored for the iPhone 17 Pro models as of January 2025: More aluminum: iPhone 17 Pro models are rumored to have an aluminum frame, whereas the iPhone 15 Pro and iPhone 16 Pro models ...
HomePod mini and Apple TV

New Apple TV and HomePod Mini Launching This Year With One Thing in Common

Wednesday January 8, 2025 6:18 am PST by
It was recently reported that new Apple TV and new HomePod mini models will launch this year, and the devices are expected to have one thing in common. Bloomberg's Mark Gurman last month reported that the new Apple TV and the new HomePod mini will be equipped with Apple's own combined Wi-Fi and Bluetooth chip. Gurman said the chip supports Wi-Fi 6E, so that could end up being a key upgrade...
iPhone SE 4 Thumb 1

New iPhone SE and iPad 11 Launch Timing Allegedly Revealed by Leaker

Tuesday January 7, 2025 11:12 am PST by
A new iPhone SE and an iPad 11 might be coming very soon. In late December, a private account on X with a track record of leaking accurate iOS-related information said devices codenamed "V59" and "J481" will be released alongside iOS 18.3 and iPadOS 18.3. Bloomberg's Mark Gurman has previously reported that "V59" is a new iPhone SE, and that "J481" is a new entry-level iPad. iOS 15.3, iOS ...
M6 MacBook Pro Feature 1

5 Reasons to Wait for Next Year's MacBook Pro

Wednesday January 8, 2025 6:33 am PST by
Apple in October 2024 overhauled its 14-inch and 16-inch MacBook Pro models, adding M4, M4 Pro, and M4 Max chips, Thunderbolt 5 ports on higher-end models, display changes, and more. That's quite a lot of updates in one go, but if you think this means a further major refresh for the MacBook Pro is now several years away, think again. Bloomberg's Mark Gurman has said he expects only a small...
airpods pro 2 botw

Hearing a Mysterious Chime From Your AirPods Pro Case? It's a Feature

Thursday January 9, 2025 3:42 pm PST by
If you've been hearing a chiming sound from your AirPods Pro 2 case when the AirPods are charging, it's a feature that Apple added with the launch of Hearing Health last year. In a support guide, Apple says that the AirPods Pro may play a sound every so often while in the case to ensure the microphones and speakers are working as intended. From Apple: To help ensure that your AirPods...
iOS 18

Apple Releases iOS 18.2.1 With Bug Fixes

Monday January 6, 2025 10:07 am PST by
Apple today released iOS 18.2.1 and iPadOS 18.2.1, minor updates to the iOS 18 and iPadOS 18 operating systems. iOS 18.2.1 and iPadOS 18.2.1 come almost a month after Apple released iOS 18.2 and iPadOS 18.2. The new software can be downloaded on eligible iPhones and iPads over-the-air by going to Settings > General > Software Update. According to Apple's release notes, iOS 18.2.1...
airpods 4 blue

Apple's Student Offer With Free AirPods Returns in These Four Countries

Thursday January 9, 2025 7:18 am PST by
Apple's annual "Back to School" or "Back to Uni" promotion has returned this week in Australia, New Zealand, Brazil, and South Korea. From January 8 through March 13, qualifying higher-education students and staff in these countries can receive free AirPods 4 with Active Noise Cancellation with the purchase of any new MacBook Air, MacBook Pro, or iMac, or a free Apple Pencil Pro or Apple...
LG UltraFine 6K Display TB5

LG Unveils UltraFine 6K Display With Thunderbolt 5 Support

Tuesday January 7, 2025 3:56 am PST by
LG has shown off a new Ultrafine 6K monitor at CES 2025. The 32-inch display is the first of its kind to support Thunderbolt 5, which Apple introduced late last year with the launch of new Mac mini and MacBook Pro models powered by M4 Pro chips. Details are scant, but we do know that the LG UltraFine 6K monitor (model 32U990A) features a Nano IPS Black panel, delivering a wide color gamut...

Top Rated Comments

sniffies Avatar
31 months ago
TikTok is a tikking bomb that needs to be defused ASAP.
Score: 53 Votes (Like | Disagree)
DHagan4755 Avatar
31 months ago
It's owned by a Chinese company with alleged ties to the CCP. If you're concerned about it, don't use it. It's quite simple.
Score: 52 Votes (Like | Disagree)
bigandtasty Avatar
31 months ago
We were told TikTok was shady and monitoring people almost 2 years ago. Nothing surprising here.
Score: 42 Votes (Like | Disagree)
ian87w Avatar
31 months ago
This is why I hate in-app browser. Let's face it, Google, Facebook, they all do/did it, which is why they're insistence in forcing users to remain in their app with these in-app browser "experience." This is an issue on Android as well, where Google searches on Google app are sticking with Chrome/in-app browser by default even if I have another browser as my default browser.

There are always shenanigans like this. I wish for Apple to simply disable in-app browsers, and force any links to just use the default browser externally.
Score: 40 Votes (Like | Disagree)
macaddict06 Avatar
31 months ago
<shocked pikachu face>
Score: 37 Votes (Like | Disagree)
TheYayAreaLiving ?️ Avatar
31 months ago
I once said, never to trust Facebook. Now I’m going to say, Never trust TikTok.
Score: 24 Votes (Like | Disagree)