Developer Felix Krause found TikTok's iOS app injecting code that could enable it to monitor all keyboard inputs and taps. Aka, keylogging.

[InAppBrowser] is stating the JavaScript commands that get executed by each app, as well as describing what effect each of those commands might have.” ...

Now Krause is back with a new tool that lets anyone see JavaScript commands injected through an in-app browser.

This vulnerability can allow an unauthenticated threat actor to send targeted phishing emails or malicious links to a user of a Cisco ASA device to execute JavaScript commands in the user's browser.

What is a Bookmarklet? The term bookmarklet comes from the words bookmark and applet, and is a browser bookmark that contains JavaScript commands to extend the browser’s functionality.