---
title: "Discussion on \"Hijacking iOS Deep Links in a Health App Using Custom URL Schemes\" | Hashnode"
description: "Discussion on \"Hijacking iOS Deep Links in a Health App Using Custom URL Schemes\". How custom URL schemes in an iOS health app exposed sensitive clinical data to any malicious app on the device. A Frida PoC writeup."
url: "https://hashnode.com/posts/hijacking-ios-deep-links-in-a-health-app-using-custom-url-schemes/69d7607bfa7251682e66c41f"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Hijacking iOS Deep Links in a Health App Using Custom URL Schemes](https://blog.dixitaditya.com/hijacking-ios-deep-links-in-a-health-app-using-custom-url-schemes?utm_source=hashnode&utm_medium=feed)

How custom URL schemes in an iOS health app exposed sensitive clinical data to any malicious app on the device. A Frida PoC writeup.

Apr 9 · 9 min read · blog.dixitaditya.com  
Read the article

-   [#security](https://hashnode.com/tag/security)
-   [#ios](https://hashnode.com/tag/ios)
-   [#pentesting](https://hashnode.com/tag/pentesting)
-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#bugbounty](https://hashnode.com/tag/bugbounty)
-   [#automation](https://hashnode.com/tag/automation)

## Written by

[Aditya Dixit](https://hashnode.com/@adityadixit)

@adityadixit · India

  
[View profile](https://hashnode.com/@adityadixit)

Security Researcher

I'm leading the Research at Credshields, and Pentest teams at Cobalt Labs and HackerOne. I occasionally blog about my findings and adventures in pentesting.

## Responses 3

Markdown supported · ⌘↵ to post

[Laura Ashaley](https://hashnode.com/@laura-ashaley)

[Apr 11](https://hashnode.com/posts/hijacking-ios-deep-links-in-a-health-app-using-custom-url-schemes/69d7607bfa7251682e66c41f/comment/69d9f0adc8e5007ddb64aa65)

This is a classic reminder of why custom URL schemes are no longer sufficient for sensitive apps. iOS deep links can be powerful, but without proper validation they become an easy attack surface for hijacking flows between apps—especially in health-related use cases where data exposure is critical. The real issue isn’t just the scheme itself, but the lack of enforced ownership and input validation on the receiving side. Moving toward Universal Links with proper domain association, strict parameter validation, and authentication checks should be the baseline. Anything less is basically leaving the door half open for abuse.