thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Deep Link Hijacking

Abuse of custom URL schemes or unverified links so a malicious app receives links intended for another app.

Definition

Custom schemes (myapp://) can be claimed by any app, enabling interception of OAuth codes or sensitive parameters. Mitigations include verified Android App Links and iOS Universal Links, PKCE for OAuth, and treating deep-link parameters as untrusted input.

Example

A malicious app registers the same custom scheme and captures an OAuth authorization code.

Exam tip

Use verified App Links/Universal Links and PKCE.

Related terms