The problem is that JavaScript is simply capable of doing things that can be subverted, Hoffman said. “Some of its capabilities allow it to be used this way,” he said.

TikTok's custom in-app browser on iOS reportedly injects JavaScript code into external websites that allows TikTok to monitor "all keyboard inputs and taps" while a user is interacting with a ...