A useful open-source project by Felix Krause can detect when iOS apps are injection additional JavaScript code to third-party webpages. This is how to use it:
1. Open any iOS app.
2. Share a link to inappbrowser.com inside the app. It can be sent as a social media post, comment, or a DM.
3. Click on the link.
4. This will open the open-source website, detect if the iOS app is injecting any JavaScript, and list that code for you to see.
5. But note that if the iOS app is using WKContentWorld for isolating JavaScript, then this inappbrowser tool will be unable to detect the JavaScript.
6. Also, there is no way for us to check how these iOS apps are using the data that can be collected with such JavaScript.
7. So, at best, we can only check if an iOS app is not using the best practices for privacy (by injecting some JavaScript to third-party websites opened inside it). Thus, it is only a basic diagnostic tool.