The OAuth 2.0 specification's authorization code mechanism includes redirect URI checking from the site you redirect to. See steps D and E in section 4.1 of the spec. Also, section 4.1.3 describes in ...
In case that a malicious mobile app hasn't the appropriate permissions to e.g. download a file, it can invoke a browser to download sth. Concrete examples of such an attack are shown from page 27 to ...