PTKDMobile App Security
Knowledge base / PTKD-PLATFORM-URLSCHEME
medium M4 MASVS-PLATFORM-1 static analysis PTKD-PLATFORM-URLSCHEME

Hijackable custom URL-scheme deep link

An exported component handles a browsable custom URL scheme (not http/https). Any other app can register the same scheme, so a crafted link can be intercepted or forged — deep-link hijacking.

How it's exploited

The app registers a browsable custom URL scheme (for example myapp://). Any other installed app can register the same scheme, so a crafted link or a malicious app can intercept the deep link, receive its parameters, or forge one the app trusts.

Why it matters

Deep-link hijacking: leaked link parameters (often tokens), spoofed navigation, and unauthorized actions driven through the handler.

How to fix it

  1. Prefer verified Android App Links (android:autoVerify="true" over https) so only your verified domain can open the link.
  2. Treat every deep-link parameter as untrusted input and validate it; guard sensitive handlers with a signature permission.

References