Preliminary research

One Tap Too Far: Using Shortcuts to Bypass Chrome for iOS Call Prompts

Leonardo Giovannini · Doyensec · 24 September 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Chrome on iOS exempted Shortcuts URLs from its app-launch prompt. An error callback for a nonexistent shortcut could then open a webpage-controlled tel or FaceTime URL outside Chrome's checks. The case study explains the two handoffs and the fix: prompt before opening Shortcuts or Workflow. Final call behavior depends on iOS and the handler.

Record

Researcher

Leonardo Giovannini

Published by

Doyensec

Date

24 September 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Earlier Shortcuts callback bypass (2025)
• Article demonstration
• Chromium fix record

Tags

• uri-scheme
• ios
• case-study

This page is the archive's own catalogue record. The research is the work of Leonardo Giovannini, first published at the original source. Preserved copies are kept so the citation survives its host.