New research suggests that Meta and Yandex used a loophole in Android to link web browsing data to app identities. The method bypassed incognito mode, cookie clearing, and other privacy protections.