9 matches found
CVE-2026-26897-EcoOnline-DeepLink
EcoOnline EHS Android — 深度链接验证绕过 → WebView 开放重定向 CVE-2026-26897 CVE-2026-26897 的公开披露/公告，该漏洞是 EcoOnline EHS Android 应用 com.airsweb.v10 中的一个深度链接验证绕过。精心构造的 ehs-app:// 深度链接会被重写为 https:// 并直接加载到应用的主 WebView 中，绕过了应用在其他导航路径上都会执行的主机白名单检查 ，从而允许远程攻击者在受信任的应用内呈现任意攻击者控制的内容（钓鱼攻击）。 已负责任地披露，供应商已确认，并已在 0.2.500 版本...
CVE-2026-26897
An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...
CVE-2026-26897
An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...
EUVD-2026-67100
An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...
CVE-2026-26897: Exposure of Sensitive Information to an Unauthorized Actor
An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...
CVE-2026-26897
The EcoOnline EHS Android application (com.airsweb.v10) version 0.2.499 is vulnerable to a deep link validation bypass in its custom URL scheme handler. The application exports an activity that handles the ehs-app:// scheme without specifying a host or path. While the app uses an allow-list for s...
PT-2026-82516
Name of the Vulnerable Software and Affected Versions EcoOnline EHS versions 0.2.499 Description A flaw in the Android application allows a remote attacker to obtain sensitive information and execute arbitrary code through the AndroidManifest.xml component. Recommendations At the moment, there is...
CVE-2026-26897
An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...
