6 matches found
CVE-2026-26897-EcoOnline-DeepLink
EcoOnline EHS Android — 深度链接验证绕过 → WebView 开放重定向 CVE-2026-26897 CVE-2026-26897 的公开披露/公告，该漏洞是 EcoOnline EHS Android 应用 com.airsweb.v10 中的一个深度链接验证绕过。精心构造的 ehs-app:// 深度链接会被重写为 https:// 并直接加载到应用的主 WebView 中，绕过了应用在其他导航路径上都会执行的主机白名单检查 ，从而允许远程攻击者在受信任的应用内呈现任意攻击者控制的内容（钓鱼攻击）。 已负责任地披露，供应商已确认，并已在 0.2.500 版本...
CVE-2026-26897
An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...
EUVD-2026-67100
An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...
CVE-2026-26897
An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...
CVE-2026-26897
CVE-2026-26897 is a deep link validation bypass in the EcoOnline EHS Android application (com.airsweb.v10), affecting version 0.2.499 . The exported MainActivity handles the custom ehs-app:// scheme via a scheme-only intent-filter (no host or path constraint). The deep-link branch performs a naïv...
