Deep Links & App Links Hijacking

A deep link is a URL that opens a specific screen inside an app, and any app can register to handle one. Custom-scheme links (myapp://) verify nothing, so a malicious app can claim the same scheme and steal the link, OAuth code and all. Verified App Links (https + assetlinks.json) close that, but only if every host is verified and the screen does not trust the URL it was handed. How link routing works, how hijacking and parameter abuse happen, and how to lock them down.