Researchers: flaws in how some browsers cache favicons can lead to website visitors being tracked, even if they are in incognito mode or use script blockers
Context & Ripple Effects
The favicon cache is the latest in a long line of browser conveniences turned tracking channels. Researchers flagged super cookies that survive privacy mode back in 2015, and third-party scripts later exploited browsers' built-in password managers to identify users — each time, a feature built for usability doubling as a persistent identifier that incognito mode and cookie controls never touched.
What makes this report distinct is the bypass vector: script blockers, the tool users reach for precisely when they distrust page code, are ineffective because the favicon request happens outside the script layer. That extends the tracking surface past the defenses the ecosystem has spent years hardening.
First-order effects
- Users who rely on incognito mode or script blockers lose their core privacy assumption: a site can re-identify a returning visitor through cached favicons alone, with no cookies or executable code required.
Second-order effects
- Browser vendors face pressure to partition or clear favicon caches alongside cookies — the same remediation path super cookies forced — while script-blocker makers must confront that their product no longer covers this class of identification.
Third-order effects
- If the pattern holds, privacy mode becomes credible only when browsers isolate every storage and cache layer by session, not just cookies — pushing tracking defense from add-on tools into browser architecture itself.
The trend: Browser features built for convenience — caches, password managers, autofill — keep resurfacing as covert tracking channels that incognito mode and script blockers were never designed to stop.