# Intent and scheme launch consent bypass

Server redirects or trusted-app callbacks that launch intents or schemes without a user gesture

_Area: Web access control and IDOR. Seen in 5 disclosed reports; 3 confirmed bounties, median $3,000, range $800-$6,200; latest 2026-09-23. Updated 2026-10-23._

## How it works
A browser or app is supposed to launch another app only after the user acts and consents. The assumption that breaks is that the first hop is the only hop: the launcher checks the URL it sees, but a server redirect, an intermediary app, or a callback scheme can re-issue a second launch that never passes the same check. Consent is enforced at one point while the actual launch happens at another.

## Where it shows up
- `intent://` or custom-scheme URLs reached via a 302/redirect rather than a click [E3](https://bugbountylibrary.com/r/p0%3ACVE-2021-38000.md)
- First-party apps that accept an intent and re-issue another intent (intent redirection) [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2024-08-01-awas.md)
- Allowlisted "trusted" app schemes (Shortcuts, Workflow) that can themselves open arbitrary URLs via x-callback-url [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-09-24-chrome-ios-policy-bypass-html.md)
- Launch prompts skipped for schemes treated as trusted Apple apps [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-09-24-chrome-ios-policy-bypass-html.md)
- User-gesture policy applied only to the first URL in a chain, not to callbacks the trusted app opens [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-09-24-chrome-ios-policy-bypass-html.md)
- Missing BROWSABLE category enforcement on forwarded intents [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2024-08-01-awas.md)

## How to review
The invariant: every app launch, at every hop, requires a fresh user gesture and consent, and the destination plus data are constrained by the launcher, not by the server or an intermediary. Check each redirect and callback path, not just the entry URL. Ask whether a 302 alone can trigger a launch [E3](https://bugbountylibrary.com/r/p0%3ACVE-2021-38000.md), whether an intermediary re-issues intents on the browser's behalf [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2024-08-01-awas.md), and whether a trusted app can open arbitrary URLs the browser never validated [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-09-24-chrome-ios-policy-bypass-html.md).

## Variants seen
- Server-driven 302 to `intent://` with attacker-chosen app and data [E3](https://bugbountylibrary.com/r/p0%3ACVE-2021-38000.md)
- Intermediary apps (Firebase Dynamic Links, Google app) laundering the BROWSABLE restriction and skipping the prompt [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2024-08-01-awas.md)
- Trusted-scheme allowlist plus x-callback-url opening tel:/facetime: without gesture checks [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-09-24-chrome-ios-policy-bypass-html.md)

## Why fixes fail
Prompt patches were bypassed by intermediary apps that redirect intents on Chrome's behalf [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2024-08-01-awas.md). Gesture checks applied only to the first URL left callbacks unguarded [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-09-24-chrome-ios-policy-bypass-html.md).

## Impact and severity
Silent app actions, URL spoofing, and escaping the browser sandbox [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2024-08-01-awas.md)[E3](https://bugbountylibrary.com/r/p0%3ACVE-2021-38000.md); calls placed without interaction [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-09-24-chrome-ios-policy-bypass-html.md). Severity is high where the destination and data are fully server-controlled [E3](https://bugbountylibrary.com/r/p0%3ACVE-2021-38000.md). Worse when a trusted intermediary or allowlisted scheme sits in the chain, since each hop looks legitimate.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2024-08-01-awas.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-09-24-chrome-ios-policy-bypass-html.md
- E3: https://bugbountylibrary.com/r/p0%3ACVE-2021-38000.md