Researchers said the in-app browser on the video-hosting service has supplementary code that may let the company track everything users type.