title: Are custom URL schemes secure?
body: <p>Suppose a user forgot their password and requested an email link to reset it. The email could contain a URI link to reset their password. If this is a URI for a register URI scheme in Android or iOS, is this secure?</p>
  
  <p>For example, if the URI were broadcast to listener applications, can a malicious app  take this URI and behind-the-scenes reset the login username and password for the user of the original site?</p>
  
  <p>Can a malicious app register to receive links from any domain, or are there restrictions? (iOS or Android)</p>
  
  <hr>
  
  <p>Update: The deep linking I'm talking about is: </p>
  
  <ul>
  <li>iOS :<a href="https://developer.apple.com/library/ios/documentation/iPhone/Conceptual/iPhoneOSProgrammingGuide/AdvancedAppTricks/AdvancedAppTricks.html" rel="nofollow noreferrer">Implementing Custom URL Schemes</a></li>
  <li>Android: <a href="https://stackoverflow.com/questions/2448213/how-to-implement-my-very-own-uri-scheme-on-android/2449500#2449500">Android Respond To URL in Intent</a></li>
  </ul>