CVE-2020-15502: 
Homebrew vulnerability analysis and mitigation

The DuckDuckGo application through version 5.58.0 for Android and through version 7.47.1.0 for iOS sends hostnames of visited websites within HTTPS .ico requests to servers in the duckduckgo.com domain, which could potentially expose user browsing data. This vulnerability was discovered in July 2020 and was assigned CVE-2020-15502. The issue was disputed by DuckDuckGo, who stated that "the favicon service adheres to our strict privacy policy" (MITRE CVE).

The vulnerability stems from the application's favicon retrieval mechanism, where the browser sends requests to DuckDuckGo's servers to fetch website icons. The implementation involves sending hostnames to a specific endpoint (https://proxy.duckduckgo.com/ip3/%s.ico) for favicon retrieval (DDG Android Code). While these requests are encrypted and DuckDuckGo claimed to discard PII like IP addresses, the design created a central point where browsing data could potentially be collected.

The vulnerability could allow DuckDuckGo to potentially track which websites users visit through their browsers, even when not using DuckDuckGo's search engine. This contradicts the privacy-focused nature of the application and creates a central point where browsing history could potentially be monitored (HN Discussion).

DuckDuckGo committed to moving the favicon retrieval process to be handled locally in the browser rather than through their servers. The company's CEO confirmed this change would be implemented ASAP after the issue gained attention (HN Discussion). A fix was later implemented to handle favicon retrieval locally.

The discovery sparked significant discussion in the privacy and security community. While some viewed it as a serious privacy concern, others considered it a design flaw rather than malicious intent. DuckDuckGo's quick response and commitment to fix the issue was generally well-received, though some criticized the initial implementation and the year-long delay in addressing the reported concern (HN Discussion).