A custom URL scheme is an app-specific link format, such as a link that starts with a nonstandard prefix, used to hand off work from a browser, email client, or another app into installed software. It is a common deep-linking mechanism: clicking the link can open a meeting, sign in to a service, or pass data directly to a desktop client.
In cyber security, these schemes matter because they create a trust boundary between the web, the operating system, and the target app. If scheme handling is weak, an attacker may trigger unintended actions, send malicious parameters, or abuse the handoff to reach sensitive functions. Defenders reduce this risk by validating every parameter, registering handlers carefully, preferring allowlisted actions, and testing whether a link can invoke privileged behavior without proper checks.