A custom protocol handler is an operating system or application component that opens links using a nonstandard scheme, such as sgbiz:, instead of ordinary http: or https:. When a user clicks such a link, the handler receives the URL, parses its parameters, and launches the associated action or app behavior.
This matters in cyber security because a handler can become a trusted entry point into local code. If it accepts attacker-controlled input without strict validation, a single click may trigger unintended navigation, file access, command execution, or a chain into an embedded browser. Defenders should treat protocol handlers as attack surface: review which schemes are registered, limit what parameters they accept, and ensure they do not bypass sandboxing or trust checks. Attackers often abuse them in phishing and one-click exploit chains because they look like harmless links but can reach privileged application logic.