BERRY9 IT Services, home +91 86868 92922

Deep-Link and Universal-Link Vulnerabilities

Deep links on Android and universal links on iOS are unauthenticated entry points into your mobile application. Any link on the web, any QR code, any push notification, any chat message can wake your app and ask it to do something. They deserve the same scrutiny as a public API endpoint. They rarely get it.

Request a scoping call Call +91 86868 92922

Mobile apps · By Thimmagurudu Bathini · Published · 6 min read · Last reviewed

  • Intent filters with android:autoVerify="false" — any app can register for the same URL pattern and intercept the link. We test for hijacking scenarios.
  • Custom-scheme links (myapp://) — never verified; any app can claim them. Sensitive actions should not be triggered via custom scheme.
  • WebView-loadable URLs from deep links — if a deep link parameter becomes a URL loaded into a WebView, you have an XSS / phishing vector inside your own app.
  • Privileged actions triggered without confirmation — change email, transfer funds, accept friend request. Each should require explicit user interaction beyond the link itself.

Universal links use the apple-app-site-association file on your domain to declare which paths your app handles. We verify the file is served correctly, the path patterns are tight (no * at the root), and that fallback to Safari behaves sanely when the app is not installed. Spoofing scenarios where another app intercepts via custom URL scheme are also tested.

Common findings

  • Authentication tokens passed in deep-link parameters — leaked to system logs, referrer headers, clipboard managers
  • Profile takeover by tricking a user to tap a crafted deep link while authenticated
  • Account binding bypass — link an attacker's social account to a victim's profile by abusing OAuth callbacks deep-linked into the app

See mobile application penetration testing.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp