1. Android allows apps to open ports without permissions. And apps to communicate with each other without permissions.
2. The browsers allow random domains to access services on the localhost. Without notifying the user. We have seen vulnerabilities in the past accessing dev services running on localhost. Something should be done there.
1a. Arbitrary apps can listen on ports without permissions.
1b. Arbitrary apps can access local ports without permissions.
I've recently been experimenting with running the browser (on my desktop) in a network namespace precisely because of these reasons. Random websites shouldn't be able to access services running on localhost.
Let me introduce you to https://www.qubes-os.org/.
But even with those technical issues present, Facebook shouldn't have done this.
Just to clarify: you need `android.permission.INTERNET`. This is a default permission (granted by default at install time with no user interaction).
GrapheneOS allows this permission to be disabled.
As far as I'm aware, you can't lock this down to 'allow only intra-app communications via localhost', please let me know if I'm mistaken.