Home / Knowledge hub / Deep link hijacking
Knowledge hub
Deep link hijacking
Another app catching a link meant for yours and reading what it carries.
What it means
A deep link is a link that opens a specific screen inside a mobile app, such as an order page or a password reset. Deep link hijacking happens when a different app claims the same link and receives it first, or when a hostile link makes your app do something it should not.
The idea that makes it click: older links use a custom scheme such as myapp://, and nothing stops two apps registering the same one. When a link carries a sign-in code or a token, whichever app catches it can read it. A link that anyone can trigger should never be trusted as proof of anything.
Why it matters
The classic harm is stolen sign-in. In an OAuth flow that returns to the app through a custom scheme, a malicious app on the same phone can capture the authorisation code and exchange it for access. A reset link or magic link caught the same way gives the attacker the account.
Deep links can also drive actions. A link that opens a payment screen with the amount pre-filled, or loads a web page inside the app, can be sent by an attacker to a user. The result is account takeover, unwanted transactions, or content injected into your own app.
How it shows up
On Android, Android App Links tie an https link to your app by a file on your domain, and the system checks the file. On iOS, Universal Links work the same way using an association file. These verified links cannot be claimed by another app, unlike custom schemes. The weakness is CWE-939, improper authorisation in a handler for a custom URL scheme.
Check for sensitive data in link parameters, OAuth returning through a custom scheme without PKCE, link handlers that skip sign-in or confirmation, and a web view that loads any address it is given. Validate every link parameter as untrusted input.
Questions people ask
Deep link hijacking, answered
What is the difference between a custom scheme and an App Link?
A custom scheme such as myapp:// can be registered by any app. An Android App Link or iOS Universal Link uses an ordinary https address that the operating system verifies belongs to your app.
Use the verified kind for anything sensitive.
Does PKCE stop deep link hijacking?
It protects the OAuth case. With PKCE, a malicious app that catches the authorisation code cannot exchange it without the secret that only your app holds.
It does not protect other links, such as reset links.
Should tokens go in deep links?
Avoid it. Anything in a link can be seen by whichever app receives it, and may be logged. If you must, make the token single-use and short-lived.
Prefer a code exchange that confirms the app and the user.
Can a web page trigger a deep link?
Yes. A web page or message can open a link to your app, so the app must treat every parameter as coming from a stranger and ask for confirmation before actions with consequences.
That includes anything affecting money or settings.
How do we test deep links?
List every scheme and link your app handles, then send each with changed or hostile parameters. Check whether another app can register the same scheme.
Check that sign-in and confirmation still happen.
Related
Terms that sit next to this one
OAuth
The standard behind every sign in with and connect your account button.
PKCE
An extra check that stops a stolen OAuth code from being swapped for a token.
OAuth redirect URI
The address a sign-in provider sends the user back to, which must be matched exactly.
Mobile penetration testing
Testing a mobile app and the services it talks to for security flaws.
Magic link
A sign-in link sent by email that replaces the password for that visit.
Who else can catch your links?
We test how your mobile backend and sign-in flows behave when a link is tampered with or replayed, and report only what we exploited. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.