Scheme flooding is a browser fingerprinting technique that uses custom URL schemes to infer which applications are installed on a device. By testing scheme handlers and observing browser behavior, a website can build a stable identifier that links sessions across browsers, private mode, and sometimes even privacy-focused browsers.
How scheme flooding works
Scheme flooding exploits the browser’s handling of custom URL schemes, such as app-specific handlers, to test which applications are present on a device. The site does not need to open the app to learn something useful; the browser’s response can reveal installation state and handler behavior.
This makes the technique a form of browser-side probing. Because the observable behavior depends on the user’s software stack, it can expose device-level characteristics even when traditional browser cookies are blocked or cleared.
Why scheme flooding is useful for fingerprinting
The value of scheme flooding is correlation, not content extraction. By combining many scheme probes, an attacker or tracker can build a more stable fingerprint than a simple browser identifier, especially when the browser is configured for private browsing or anti-tracking features.
That stability matters because the fingerprint can persist across sessions and sometimes across browsers on the same device. In practice, the technique expands fingerprinting from browser state into the wider application environment, which makes simple cookie-based protections less effective.
What scheme flooding can reveal about a device
Scheme flooding can reveal whether particular apps appear installed, whether handlers are registered, and how a browser reacts to invalid or blocked launches. Those signals can be combined with other browser fingerprint attributes to increase uniqueness and tracking reliability.
The technique is usually indirect, but indirect signals can still be highly identifying when they are aggregated. The privacy concern is not that a website learns the app’s internal data, but that it learns enough about the device ecosystem to distinguish one user from another.
Why defenders should care
Scheme flooding is part of a broader class of browser fingerprinting methods that undermine user expectations about privacy modes and cross-site isolation. It can also create policy and compliance concerns when application presence, behavior, or inferred device state is used without meaningful user awareness.
Security teams should treat custom-scheme probing as a privacy and tracking issue, not just a browser quirk, because the technique can sidestep common controls that were designed around cookies rather than device- and application-level signals.
Risk and Threat Considerations
Scheme flooding can enable durable cross-session tracking and device profiling, even when users rely on private browsing or clear cookies. The risk is most serious when the technique is combined with other fingerprinting signals, because the result can approximate a stable identifier without explicit consent.
Failure mechanism: The browser exposes distinguishable behavior when a page tests many custom URL schemes, and those responses can be aggregated into a unique profile of installed apps and handler support.
Impact: Trackers can correlate visits across sessions and browsers, reduce the effectiveness of privacy controls, and infer sensitive device or usage characteristics from the application footprint.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.DS-10 — Integrity | Scheme flooding affects the integrity of privacy protections and fingerprint resistance. |
| PR.AA-01 — Identity Management, Authentication, and Access Control | Custom-scheme probing can influence access and trust decisions tied to device/browser state. | |
| Recommendation — Limit device and browser fingerprint exposure through privacy-preserving configuration and monitoring. Treat browser-exposed state as sensitive and minimize what access-related signals are disclosed. | ||
| NIST SP 800-53 Rev 5 | SC-30 — Concealment and Misdirection | Scheme flooding relies on observable browser behavior that defenders can reduce through concealment controls. |
| CM-6 — Configuration Settings | Browser and application-handler configuration determines whether custom-scheme probing is exposed. | |
| Recommendation — Reduce externally observable application and device signals that support fingerprinting. Standardize browser and endpoint settings that limit custom-scheme exposure. | ||
| ISO/IEC 27001:2022 | A.8.28 — Secure coding | Browser and app behavior that exposes installation state reflects software behavior that should be privacy-safe by design. |
| Recommendation — Design application and browser interactions to avoid unnecessary exposure of device state. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | Scheme flooding is an application-side privacy issue that belongs in secure software behavior and testing. |
| Recommendation — Test web applications for fingerprinting behaviors that reveal installed software or handler state. | ||
Related resources from NHI Mgmt Group
- How should teams reduce risk in Active Directory without flooding analysts with alerts?
- How should scheme operators govern OpenID for Verifiable Credentials implementations?
- What should organisations change after a large-scale labour fraud scheme?
- How should security teams respond when inbox flooding hides critical identity notifications?
