The awards were handed out last week, to Acar, Zuiderveen Borgesius and their colleagues from the KU Leuven and the IMDEA Networks Institute. They received the award for their discovery of a previously unknown tracking technique, which silently tracks users between web browsers and mobile applications without informing them. The research is described in their paper published last year ('Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost'). Earlier this summer, the team also received the CNIL-Inria Privacy Award 2026.
About the Internet Defense Prize and the Distinguished Paper Award
Annually, the Internet Defense Prize is awarded to research that meaningfully makes the internet more secure. Created in 2014, the award is funded by Meta and offered in partnership with USENIX to celebrate contributions to the protection and defense of the internet. USENIX is a a non-profit organization for computer scientists, system administrators, engineers, and researchers. Amongst other activities, it hosts a conference every year.
USENIX awards the Internet Defense Prize to researchers that provide a working prototype which demonstrates significant contributions to the security of the internet, particularly in the areas of prevention and defense. The award is meant to recognize the direction of the research and not necessarily its progress to date, and aims to inspire researchers to focus on high-impact areas of research. The USENIX Security Awards Committee—selected by the Program Chairs among the symposium Program Committee members—independently determines the prize, to be distributed by USENIX.
At this year's USENIX Security Symposium, one of the world's top four international cybersecurity conferences, the team further received a Distinguished Paper Award.
Hidden tracking
In their paper, the researchers show how Meta and Yandex can circumvent the privacy safeguards between web and app environments on Android devices. This allowed Meta and Yandex to link data from web browsers to their own Android apps, including Facebook, Instagram, Yandex Maps and Yandex Search.
By embedding tracking code in millions of websites, Meta's Pixel and Yandex Metrica were able to map the browsing behaviour of Android users based on their persistent identity (i.e. with the account holder logged in). This method circumvents the privacy protection offered by Android's permission controls and even browsers' incognito mode, affecting all major Android browsers.
Impact
The international research team, including researchers from IMDEA Networks (Spain) and KU Leuven (Belgium), reported the issue to several browser vendors, mobile platforms and data protection agencies. In response, multiple vendors have developed or announced measures to counter this form of tracking.