A comprehensive study across 4,700 websites uncovered a troubling trend: 64% of third-party applications are accessing sensitive user data without legitimate business reasons—a significant jump from 51% just a year ago.

But here's what's important to understand: this isn't about new zero-day exploits or sophisticated hacking techniques. Instead, the culprit is governance oversight. Marketing scripts and tag managers are the primary culprits, quietly collecting data that shouldn't leave users' systems.

This raises critical questions about how crypto platforms and Web3 apps handle third-party integrations. Better permission auditing and stricter vendor management could close these gaps fast.