auditing-mobile-deeplink-trustlisted

# Auditing mobile deep-link trust: when an attacker's URL drives a trusted action A deep link is attacker-reachable input: a custom scheme any app can claim, or a link another app or a web page can fire, carrying parameters the app routes into an action. The bug is trusting that URL, letting a parameter reach a sensitive operation, or handing an attacker-controlled URL to a WebView that exposes a JavaScript bridge back into the app. This audit reads the deep-link routing, the URL handling, and the WebView configuration and asks, per link, whether an attacker-supplied URL can drive something it should not. It pairs with the component-exposure skill: that one owns whether the receiving component is reachable across the app boundary, this one owns whether the URL it carries is trusted. Keep the seam clean so a single flaw is reported once. ## When to use - The app registers a custom scheme, an app link, or a universal link, and routes the URL to an action. - A deep-link parameter flows into navigation, a WebView load, an authentication step, or a state change. - You want to know whether an attacker-supplied URL can drive a sensitive action or reach a trusted WebView. ## Scope check Audit only apps you own or are authorized to assess, and fire a deep link only at a device or emulator in scope, a crafted link drives real app state and can complete real actions. Adjudicate on the routing and the WebView config. If you can't name the authorization, stop. ## The loop 1. **Esta