Deep link / URL scheme / intent abuse

When it applies

The app registers custom URL schemes or App/Universal Links, or exports activities that accept data. A malicious link (in a web page, another app, or a QR) can then drive the app.

Why it works

Deep-link handlers receive attacker-controlled data and often trust it: they redirect, load it into a WebView, pass it to auth flows, or open privileged screens without re-checking who sent the intent. Custom schemes aren't verified for ownership (unlike App Links), so any app can claim them.