Links that try to run code instead of opening a site
A URL scheme tells the device what kind of action to take. Some schemes open websites; others can trigger apps, files, scripts, or system actions.
dangerous_url_schemeHow to read this alert
Treat this as a signal to slow down and verify the destination, the request, and the audience. The alert does not mean every related page is malicious. It means there is enough risk that the normal click-through habit is not good enough.
The safest response is to separate the message from the account, service, or person it claims to represent. Open the real service from a bookmark, typed address, password manager, or trusted app instead of letting the suspicious page choose the path for you.
What to check before you trust it
- The link starts with something other than `http:` or `https:`.
- The link tries to open a script, app command, file, shell, or phone action unexpectedly.
- The page asks you to approve an external application launch.
- The action would run code, open a local file, or start a call instead of showing a web page.
Decision path
Is the page asking for a login, payment, download, private context, automated action, or approval?
Compare the actual destination, signal tags, sender, and page behavior against what you expected.
If the request is sensitive or surprising, leave the link and use a known-good path or trusted person.
Examples
What to do next
- Cancel unexpected app, file, command, or script prompts.
- Check whether the action matches what you were trying to do.
- Use the official application or website directly.
- Ask IT before approving links that launch remote access, scripts, or device-management tools.
Common mistakes
- Clicking through browser prompts without reading them.
- Treating app-launch links as normal websites.
- Allowing a page to open a local helper app after a scare message.
Test the decision before you leave
This short quiz stays in your browser. It is meant to reinforce the safe habit, not grade or track you.