diff --git a/apps/raycast-extension/src/search-memories.tsx b/apps/raycast-extension/src/search-memories.tsx
index dbc47ceb7..fcc495d21 100644
--- a/apps/raycast-extension/src/search-memories.tsx
+++ b/apps/raycast-extension/src/search-memories.tsx
@@ -42,7 +42,18 @@ const extractContent = (memory: SearchResult) => {
 
 const extractUrl = (memory: SearchResult) => {
 	if (memory.metadata?.url && typeof memory.metadata.url === "string") {
-		return memory.metadata.url
+		const url = memory.metadata.url
+		// Server-controlled value: only offer http(s). Without a scheme
+		// allowlist, a crafted memory could hand javascript:, file:, or
+		// arbitrary app-handler URLs to the OS opener.
+		try {
+			const parsed = new URL(url)
+			if (parsed.protocol === "https:" || parsed.protocol === "http:") {
+				return url
+			}
+		} catch {
+			return null
+		}
 	}
 	return null
 }