Improper deep link validation in McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to launch an arbitrary URL within the app.
CWE-94 Improper Control of Generation of Code ('Code Injection')