URL Scheme Hijacking & Universal Links

Custom URL schemes like myapp:// feel like the app owns them — but the OS never promised they are unique. Any app can register myapp://, and if your OAuth redirect carries a token over that scheme, a rogue app that claimed it gets the token. This walks scheme hijacking, why universal links and App Links fix it by binding to a domain you must prove you control, and the bug that survives both: a deep link is still attacker input that can drive a handler into a sink.