Android apps increasingly rely on deep links and WebViews to handle navigation and render web content —

but these mechanisms come with a mineeld of subtle security pitfalls that developers routinely miss and

attackers actively exploit.

In this talk, we take a look at the attack surface formed by the intersection of URI handling and WebViews.

We'll walk through the most common mistakes in deep links that route into WebViews, covering custom

URI scheme abuse, URL confusion across popular parsers, and WebView takeover bugs , showing how to

spot them, exploit them, escalate them, and mitigate them.

Topics covered include:

Whether you're a mobile security researcher, a penetration tester, or a developer who wants to understand

how these bugs are found and fixed, this talk will be an entrypoint into the world of webview-related bugs.