Deep Link Hijacking
Custom URL schemes without host verification let malicious apps intercept your app's deep links and steal OAuth tokens or sensitive parameters.
How It Works
When you register a URL scheme like myapp://, any app can claim that scheme. If your OAuth flow redirects to myapp://callback?token=xyz, a malicious app registered with the same scheme intercepts it first and steals the token. Android and iOS both allow multiple apps to handle the same scheme.
// BAD: custom scheme with no host verification — interceptable by any app
// app.json (Expo)
{
"scheme": "myapp" // any app can intercept myapp:// links
}// GOOD: use universal links (HTTPS) which are domain-verified
// app.json (Expo)
{
"scheme": "myapp",
"intentFilters": [{
"action": "VIEW",
"data": [{ "scheme": "https", "host": "myapp.com" }]
// iOS: requires apple-app-site-association file on your domain
}]
}Real-World Example
CVE-2019-14801 demonstrated deep link hijacking in multiple popular Android apps. Attackers published apps with matching URL schemes to the Play Store, intercepting OAuth tokens from legitimate apps.
How to Prevent It
- Use Universal Links (iOS) and App Links (Android) with HTTPS instead of custom URL schemes for OAuth
- Validate the redirect URI server-side against a whitelist of allowed URIs
- Use PKCE (Proof Key for Code Exchange) in OAuth flows to bind tokens to the initiating app
- Never pass tokens or sensitive data in URL parameters — use server-side sessions
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
Clipboard Exposure
lowSensitive data copied to the clipboard (passwords, tokens, card numbers) persists there indefinitely and can be read by any app.
Screenshot Not Prevented
lowBanking and payment screens without screenshot protection allow sensitive data to be captured by malware or appear in Android's recent apps screen.
Certificate Pinning Missing
highWithout certificate pinning, attackers on the same network can intercept your app's HTTPS traffic with a rogue certificate authority.
Root/Jailbreak Detection Missing
mediumRunning a financial or health app on a rooted or jailbroken device means all security controls can be bypassed by the device owner.