They can instruct the browser to log/leak HTTPS keys: https://textslashplain.com/2019/08/11/spying-on-https/ https://textslashplain.com/2019/08/11/spying-on-htt

They can instruct the browser to log/leak HTTPS keys: https://textslashplain.com/2019/08/11/spying-on-https/ https://textslashplain.com/2019/08/11/spying-on-https/ NB this article also notes the selling of data - from the article it cites: > Jumpshot is the data arm of Avast[...] This suite of products, in order to function, must collect and analyze every URL visited by every browser of every machine on which its installed. [...] Because Avast has to see and process all these URLs anyway (in order to serve their function of providing web security), they anonymize, aggregate, and remove any personally-identifiable information from the browser URL visits and then provide them to Jumpshot, who then makes estimates about broad web usage behavior. In my opinion, this is both an ethical way to gather crucial data about what’s happening on the web[...]