It is also likely to come from a mobile app.
Another vulnerability is the mobile device (smart phone). At the moment, this thing is nothing other than a spy in your pocket with nearly no real protection from people whom want to pull data out of it. At a minimum, this thing will give-away your location in real-time for as long as it is connected to a network. Best practices for limiting data leakage is avoid installing apps that are really not necessary for daily life. Anybody who wants to claim that one vendor / OS is better than the other is fooling themselves as one nameless company is better about burying reports of threat vectors than its competition (whom more openly embraces and fixes). Then again, the mobile carriers (the ones with the phone / data contracts) at best get fair to poor marks for making sure their 'branded' version of the OS remains current with patching against vulnerabilities.
Using a mobile device for social media and games is fine, but best practice is to do this on a second device and *NOT* on the mobile device which has information (or browse) that you care for other people *not* to have.
Real life case in point: A nameless family member swears that my warnings about their favorite mobile phone / toy goes to deaf ears as that vendor simply cannot have any security issues as that company is *soooooo* good at what it does. This family member even found enjoyment in telling others how I was *sooooo* wrong as none of the warnings had *ever* actually happened. Roll forward to just the other day when I gave a birthday present that was never seen before nor was the family member aware of its existence (the product, not the fact that it was a surprise). Saw this family member again the next day and I got a comment that it was creepy how a few hours after the present was delivered, ads for that *exact* product started to appear on the mobile device. Hmmmm . . . Naturally, I asked whether good hygene was used by logging off of social media apps after each post (not that it really helps in the case of a few highly popular offenders) and the response was: "No." So, go figure, that little 'highly secure' toy actually used the mic to record its surroundings and report back to Big Brother Social Media. Yeah, I'm the alarmist fool alright . . .
Personally, I have no expectation of privacy on the Internet, but see no reason to make it easy for others to grab data as a part of 'free' apps.