New Research Exposes Critical Gap: 64% of Third-Party Applications Access Sensitive Data Without Authorization

**Reflectiz** released its 2026 State of Web Exposure Research, finding a significant rise in client‑side risk: 64% of third‑party apps access sensitive data without valid justification, public‑sector malicious activity jumped from 2% to 12.9%, and 1 in 7 education sites show active compromise. The study attributes much of the exposure to over‑permissioned marketing and third‑party tools (e.g., Google Tag Manager, Shopify, Facebook Pixel), and notes compromised sites exhibit more external connections, trackers, and recently registered domains. The 43‑page report offers sector breakdowns, a list of high‑risk applications, technical indicators of compromise, and best‑practice guidance.