EUVD-2026-67100
GHSA-2pvm-92qx-mc83
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted deep link to victim
-
ExploitVictim opens link on device with app v0.2.499
-
ExecutionExported AndroidManifest component processes untrusted input
-
ImpactLeak app-private data and execute code in app sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the EcoOnline EHS Android app (com.airsweb.v10) v0.2.499 installed on the target device, and invocation of the vulnerable exported AndroidManifest.xml component - per the PoC, via a crafted deep link. Exploitation is realistically gated by user interaction (the victim must open the malicious link) or by a malicious app already present on the device able to fire the intent; it is not a remote-network attack against a listening service despite the input's UI:N/AV:N. Limiting factors: single specific app must be installed, attack is per-device (not mass-scannable), resulting code execution is confined to the app sandbox, and delivery typically depends on social engineering. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) is almost certainly overstated for a mobile deep-link/exported-component flaw. Realistic exploitation of an Android deep link requires the victim to open a crafted link or have a malicious co-located app trigger the component - i.e., user interaction (UI:R) and no true 'network unauthenticated against a listening service' surface - and code execution is confined to the app sandbox (S:U), so full A:H is doubtful. The low EPSS (0.31%, 23rd percentile) and absence of KEV align with this: despite the 9.8 headline, the signals point to low real-world exploitation likelihood, and any exploitation would be targeted/social-engineering-driven rather than mass/automatable. The available PoC does raise practical exploitability for a determined attacker who can get a target to interact. Net: high theoretical severity, but the CVSS overstates it and the priority for most defenders is moderate, gated by user interaction and the niche nature of the app. |
| Exploit ScenarioDerived | An attacker crafts a malicious deep link (or a rogue app targeting the exported component) and delivers it to an EcoOnline EHS user via phishing email, SMS, or a web page; when the victim opens the link on a device with v0.2.499 installed, the exported AndroidManifest component processes attacker-controlled input, disclosing app-private/sensitive data and running code inside the app's sandbox. A public PoC ('CVE-2026-26897-EcoOnline-DeepLink') demonstrates the deep-link path, lowering the bar for a working exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Information disclosure and in-app arbitrary code execution affect the EcoOnline EHS Android application (package com.airsweb.v10) version 0.2.499, where an improperly protected/exported AndroidManifest.xml component (a public PoC names it a DeepLink issue) lets a remote attacker access sensitive data and run code within the app's context. The MITRE-assigned record carries a CVSS of 9.8 and CWE-200, but EPSS is low (0.31%, 23rd percentile) and there is no CISA KEV listing. Publicly available exploit code exists (GitHub 'CVE-2026-26897-EcoOnline-DeepLink'), though this is not evidence of active exploitation.
RemediationAI
No vendor-released patched version is identified at time of analysis; the description names 0.2.499 as vulnerable but no fixed build is cited in the references. Users and administrators should upgrade to the latest EcoOnline EHS release from Google Play once EcoOnline publishes a fix that removes or properly protects the exported deep-link component, and should track EcoOnline's official channels for an advisory (only researcher/PoC links exist so far: the PoC at https://github.com/iwallplace/CVE-2026-26897-EcoOnline-DeepLink and NVD https://nvd.nist.gov/vuln/detail/CVE-2026-26897). As compensating controls for a mobile app you cannot patch server-side: instruct users not to open EcoOnline deep links from untrusted sources (email/SMS/chat), which reduces the delivery path at the cost of some in-app linking convenience; in managed (MDM/MAM) fleets, restrict installation to the vetted store version and consider app-config/allowlisting or containerization to limit the app's access to sensitive data; and monitor for a vendor build that marks the component non-exported or validates deep-link input. Verify affected/fixed versions directly with EcoOnline before large-scale rollout, since version data here is unconfirmed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected asset is an Android mobile application (com.airsweb.v10, the airsweb/EcoOnline EHS environment-health-safety client), not a server or web platform. The root cause is an exposed Android component declared in AndroidManifest.xml - the public PoC repository ('EcoOnline-DeepLink') indicates the entry point is a deep link handled by an exported Activity/component. On Android, an exported component (or one with an intent-filter registering a custom scheme/host) can be invoked by any other app or by a crafted URI, and if it forwards untrusted input into a WebView, file loader, or IPC path it can leak app-private data and execute attacker-controlled code inside the app sandbox. The assigned CWE-200 (Exposure of Sensitive Information) captures the disclosure facet but not the 'execute arbitrary code' claim in the description, so the weakness class is partially mislabeled (CWE-749/CWE-926, improper export/deep-link handling, would fit better). CPE is a non-informative 'n/a:n/a' placeholder, so exact affected-product enumeration relies on the free-text description.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Android deep-link exploitation requires the victim to open a crafted link (UI:R); code exec is app-sandboxed (S:U) with high confidentiality/integrity impact but limited availability effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component
Executive ViewAI
EcoOnline EHS Android application version 0.2.499 contains a critical remote vulnerability enabling unauthenticated access to sensitive occupational health and safety compliance data, with potential for unauthorized code execution within the app's security context. This affects all users relying on the application for incident reporting and safety record management. No vendor patch is currently available, creating immediate operational risk for organizations dependent on this application for regulatory compliance.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict application network access to isolated, monitored network segments; disable non-critical EHS functions; segregate or quarantine devices running this version; implement enhanced monitoring for unusual app behavior and data transmission; begin formal evaluation and piloting of alternative EHS platforms as migration bridge pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB