external-protocol-flooding | Scheme flooding vulnerability: how it works and why it is a threat to anonymous browsing

external-protocol-flooding is a TypeScript library. external-protocol-flooding has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. You can download it from GitHub.

The scheme flooding vulnerability allows an attacker to determine which applications you have installed. In order to generate a 32-bit cross-browser device identifier, a website can test a list of 32 popular applications and check if each is installed or not. On average, the identification process takes a few seconds and works across desktop Windows, Mac and Linux operating systems. To check if an application is installed, browsers can use built-in custom URL scheme handlers. You can see this feature in action by entering skype:// in your browser address bar. If you have Skype installed, your browser will open a confirmation dialog that asks if you want to launch it. This feature is also known as deep linking and is widely used on mobile devices, but is available within desktop browsers as well. Any application that you install can register its own scheme to allow other apps to open it.