Huh, I never thought about this. I would guess an active MITM attack (breaking TLS) would work as well, since the server returns a 301 or something to airbnb://

Huh, I never thought about this. I would guess an active MITM attack (breaking TLS) would work as well, since the server returns a 301 or something to airbnb:// which we could intercept and act on?