Meta and search engine company Yandex have been "covertly tracking" Android users in the background of their devices, according to experts.