一句话：揭示 Android app link 的验证可被 Instant Apps 绕过，其安全性不如宣称。
Android deep link 可将用户从网页带到移动应用的具体页面，而 Android 6.0 引入的 app link 被宣传为更安全：它支持 Instant Apps，并通过验证机制防止此前 deep link 面临的劫持攻击。本文对这一安全声明提出挑战，指出 app link 的验证过程可被利用 Instant Apps 绕过，因而并不具备其宣称的安全性。摘要未展开具体攻击步骤与实验规模，但核心发现表明 app link 的安全模型存在被绕过风险，需要重新审视其验证机制与 Instant Apps 交互带来的威胁。
Android deep link is a URL that takes users to a specific page of a mobile app, enabling seamless user experience from a webpage to an app. Android app link, a new type of deep link introduced in Android 6.0, is claimed to offer more benefits, such as supporting instant apps and providing more secure verification to protect against hijacking attacks that previous deep links can not. However, we find that the app link is not as secure as claimed, because the verification process can be bypassed by exploiting instant apps.
@inproceedings{paperbot5767,
title = {All your app links are belong to us: understanding the threats of instant apps based attacks},
author = {Yutian Tang and Yulei Sui and Haoyu Wang and Xiapu Luo and Hao Zhou and Zhou Xu},
booktitle = {FSE},
year = {2020},
doi = {10.1145/3368089.3409702}
}