# Deep link URL into WebView

External URL reaching a WebView or rendered link without scheme and host validation

_Area: Mobile app security. Seen in 6 disclosed reports; 3 confirmed bounties, median $6,337, range $750-$8,500; latest 2022-09-23. Updated 2026-10-23._

## How it works
A deep link, intent extra, or API field carries a URL that the app hands to a WebView without checking its scheme or host. The handler assumes the URL is one the app produced or points at a trusted origin. When that breaks, attacker-chosen URLs load in the app's privileged context: `javascript:` and `file:` schemes execute or read local data [E4](https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-facebook-bug-bounty-09-18-html.md), and arbitrary hosts receive session tokens or cookies the WebView attaches [E3](https://bugbountylibrary.com/r/h1%3A328486.md)[E6](https://bugbountylibrary.com/r/h1%3A532225.md). Exposed JS bridges make any such load worse, since bridges ignore origin [E2](https://bugbountylibrary.com/r/h1%3A401793.md)[E5](https://bugbountylibrary.com/r/h1%3A1343300.md).

## Where it shows up
- Manifest deep link filters whose handlers pass a URL parameter straight to a WebView loader [E1](https://bugbountylibrary.com/r/h1%3A1372667.md)[E2](https://bugbountylibrary.com/r/h1%3A401793.md)[E3](https://bugbountylibrary.com/r/h1%3A328486.md)[E5](https://bugbountylibrary.com/r/h1%3A1343300.md)[E6](https://bugbountylibrary.com/r/h1%3A532225.md)
- WebView settings enabling JavaScript and native JS bridges alongside URL loading (amplifier, not the loader gap itself) [E2](https://bugbountylibrary.com/r/h1%3A401793.md)[E5](https://bugbountylibrary.com/r/h1%3A1343300.md)
- Multiple loader paths where one branch skips the host check the other applies [E6](https://bugbountylibrary.com/r/h1%3A532225.md)
- UI flags or extra params (e.g. `navigation_bar_type=transparent`) selecting the unchecked branch [E6](https://bugbountylibrary.com/r/h1%3A532225.md)
- React Native APKs with `react_native_routes.json` listing routes and URL-typed params [E4](https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-facebook-bug-bounty-09-18-html.md)

## How to review
For every path from an external input (deep link, intent extra) to a WebView load, confirm an allowlist check on both scheme and host runs on that exact path before loading. The invariant: only `https` URLs whose host is on a fixed trusted list may reach the WebView, and every branch enforces it. Check that no flag or parameter selects a loader that bypasses validation [E6](https://bugbountylibrary.com/r/h1%3A532225.md).

Adjacent shapes need their own invariant, not the loader one:
- Special-case rewrites: a rewritten URL must be re-validated before load [E1](https://bugbountylibrary.com/r/h1%3A1372667.md).
- API-stored deeplinks: internal schemes (`fbinternal://`, `app://`) must be rejected on write at the API boundary, not just at launch [E4](https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-facebook-bug-bounty-09-18-html.md).

## Variants seen
- `/verify?proceed_to=` special-case rewrites the URL without re-validating it, leaking a bearer token [E1](https://bugbountylibrary.com/r/h1%3A1372667.md)
- `javascript:` and `file:` URIs via deeplink URL params [E4](https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-facebook-bug-bounty-09-18-html.md)
- Host check present on one branch, skipped on another via a UI flag [E6](https://bugbountylibrary.com/r/h1%3A532225.md)
- Unsanitized deep-link URL plus exposed JS bridges; string-breakout injection through the URL parameter executes JS with full bridge access [E5](https://bugbountylibrary.com/r/h1%3A1343300.md)
- Internal deeplink schemes stored through a Graph API CTA field [E4](https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-facebook-bug-bounty-09-18-html.md)

## Why fixes fail
A host check on the normal path does not cover a second loader branch reachable by a UI flag [E6](https://bugbountylibrary.com/r/h1%3A532225.md); a special-case rewrite of the URL must re-validate the rewritten value [E1](https://bugbountylibrary.com/r/h1%3A1372667.md).

## Impact and severity
Leaked bearer tokens and session cookies (account takeover), local file read, and JS injection on privileged origins [E1](https://bugbountylibrary.com/r/h1%3A1372667.md)[E2](https://bugbountylibrary.com/r/h1%3A401793.md)[E3](https://bugbountylibrary.com/r/h1%3A328486.md)[E4](https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-facebook-bug-bounty-09-18-html.md)[E5](https://bugbountylibrary.com/r/h1%3A1343300.md)[E6](https://bugbountylibrary.com/r/h1%3A532225.md). Severity rises when the WebView carries auth tokens or file access, when JS bridges are exposed [E2](https://bugbountylibrary.com/r/h1%3A401793.md)[E5](https://bugbountylibrary.com/r/h1%3A1343300.md), and when the input is remotely settable (API) rather than requiring a local app [E4](https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-facebook-bug-bounty-09-18-html.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1372667.md
- E2: https://bugbountylibrary.com/r/h1%3A401793.md
- E3: https://bugbountylibrary.com/r/h1%3A328486.md
- E4: https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-facebook-bug-bounty-09-18-html.md
- E5: https://bugbountylibrary.com/r/h1%3A1343300.md
- E6: https://bugbountylibrary.com/r/h1%3A532225.md