Medium CVE-2026-26897 patched

EcoOnline EHS Android App — Deep Link Validation Bypass to WebView Open Redirect (CVE-2026-26897)

by Ahmet Mersin (GitHub @iwallplace, HackerOne iwallplace) · 2026-07-05

CVSS 6.3/10

Severity: Medium
CVE: CVE-2026-26897
Category: web
Affected product: EcoOnline EHS for Android (com.airsweb.v10)
Affected versions: 0.2.499 (versionCode 44631) and earlier
Disclosed: 2026-07-05
Patch status: patched

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-06
Author / Researcher	Ahmet Mersin (GitHub @iwallplace, HackerOne iwallplace)
CVE / Advisory	CVE-2026-26897
Category	web
Severity	Medium
CVSS Score	6.3 (Medium) — researcher estimate, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Status	PoC
Tags	android, deep-link, webview, open-redirect, phishing, cwe-939, mobile-security, ecoonline
Related	N/A

Affected Target

Field	Value
Software / System	EcoOnline EHS for Android (`com.airsweb.v10`)
Versions Affected	0.2.499 (versionCode 44631) and earlier
Language / Platform	Android (Kotlin/Java), WebView; PoC is a static HTML page
Authentication Required	No
Network Access Required	Yes (victim must open a crafted deep link)

Summary

EcoOnline EHS for Android is a WebView wrapper app that loads its content from a trusted domain and enforces a host allow-list (isInternalHost) whenever it restores or navigates URLs. The app also registers an exported, scheme-only custom URL handler (ehs-app://) via MainActivity. The deep-link handling branch takes the incoming URI, naively rewrites the scheme from ehs-app: to https:, and passes the result straight to WebView.loadUrl() without ever calling the allow-list check used elsewhere in the same file. As a result, any attacker-controlled https:// origin can be loaded inside the trusted app chrome simply by getting the victim to tap a crafted ehs-app:// link. The included PoC is a benign HTML page that proves the arbitrary-origin load with no data collection or network calls.

Vulnerability Details

Root Cause

The deep-link intent handler in MainActivityKt.WebViewPage performs a string-level scheme substitution (ehs-app: → https:) and calls loadUrl() directly, skipping the isInternalHost() domain allow-list that guards every other WebView navigation path in the app.

Attack Vector

Attacker hosts arbitrary content (e.g., a look-alike login page) at any origin they control.
Attacker crafts a link of the form ehs-app://attacker.example/login and delivers it via email, SMS, chat, or QR code.
Victim, who has the vulnerable EcoOnline EHS app installed, taps the link.
The exported MainActivity deep-link handler rewrites the scheme and loads https://attacker.example/login into the app’s main WebView without validating the host.
The attacker page renders with the trust and chrome of the legitimate app, enabling credential phishing or other UI spoofing.

Impact

An attacker can render arbitrary web content inside a trusted enterprise safety/EHS application, enabling convincing phishing (e.g., fake login prompts) that inherits the app’s perceived trust.

Environment / Lab Setup

Target:   EcoOnline EHS Android app (com.airsweb.v10) version 0.2.499, versionCode 44631
Attacker: Android test device with the vulnerable APK installed; any web host to serve the redirect target; a way to deliver a deep link (email/SMS/QR/web page)

Proof of Concept

PoC Script

See redirect-proof.html in this folder.

1
ehs-app://<your-host>/redirect-proof.html

The page is a neutral landing page that, once loaded inside the app’s WebView via the deep-link bypass, displays read-only runtime context (loaded URL, referrer, user-agent) to prove the arbitrary-origin load. It performs no credential capture, form submission, or network requests.

Detection & Indicators of Compromise

Signs of compromise:

Users reporting an unexpected login prompt inside the EcoOnline EHS app
WebView traffic from the app to domains outside the vendor’s allow-list
Receipt of unsolicited ehs-app:// links via email/SMS/chat

Remediation

Action	Detail
Primary fix	Update to `com.airsweb.v10` version 0.2.500 or later
Interim mitigation	Avoid opening unsolicited `ehs-app://` links; enterprises can restrict app installation to vendor-verified updates and educate users on deep-link phishing

References

Source repository

Notes

Mirrored from https://github.com/iwallplace/CVE-2026-26897-EcoOnline-DeepLink on 2026-07-05.

redirect-proof.html

html raw GitHub ↓ Download

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>PoC — CVE-2026-26897</title>
<style>
  :root { color-scheme: light; }
  body { margin:0; font-family:-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;
         background:#f5f6f8; color:#1b1f24; line-height:1.5; }
  .wrap { max-width:680px; margin:0 auto; padding:24px 18px 48px; }
  .banner { background:#b3261e; color:#fff; border-radius:10px; padding:16px 18px;
            font-weight:600; font-size:18px; }
  .banner small { display:block; font-weight:400; opacity:.92; margin-top:4px; font-size:13px; }
  .card { background:#fff; border:1px solid #e2e5e9; border-radius:10px; padding:18px; margin-top:16px; }
  h2 { font-size:15px; margin:0 0 10px; }
  code, .mono { font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace; font-size:12.5px;
                word-break:break-all; }
  .kv { display:grid; grid-template-columns:130px 1fr; gap:6px 12px; font-size:13px; }
  .kv div:nth-child(odd){ color:#5b626b; }
  .note { font-size:12.5px; color:#5b626b; margin-top:16px; }
  .ok { color:#0a7d33; font-weight:600; }
</style>
</head>
<body>
  <div class="wrap">
    <div class="banner">
      ⚠️ Proof of Concept — CVE-2026-26897
      <small>EcoOnline EHS (Android, com.airsweb.v10) — Deep Link Validation Bypass</small>
    </div>

    <div class="card">
      <h2>What just happened</h2>
      <p>This page was loaded <strong>inside the trusted EcoOnline EHS application's WebView</strong>
      via an <strong>unvalidated <code>ehs-app://</code> deep link</strong>. The deep-link handler
      rewrites the scheme to <code>https:</code> and calls <code>WebView.loadUrl()</code> without
      applying the app's host allow-list (<code>isInternalHost()</code>), so an attacker-chosen origin
      is rendered with the look and trust of the legitimate app.</p>
      <p>In a real attack this slot would hold a spoofed login or other social-engineering content.
      <span class="ok">This demonstration page does none of that.</span></p>
    </div>

    <div class="card">
      <h2>Runtime context (read-only)</h2>
      <div class="kv">
        <div>Loaded URL</div><div class="mono" id="loc">&mdash;</div>
        <div>Referrer</div><div class="mono" id="ref">&mdash;</div>
        <div>User-Agent</div><div class="mono" id="ua">&mdash;</div>
        <div>Timestamp</div><div class="mono" id="ts">&mdash;</div>
      </div>
    </div>

    <p class="note">
      Benign security-research PoC for a <strong>fixed</strong> vulnerability (patched in
      com.airsweb.v10 0.2.500). It has <strong>no input fields</strong>, captures
      <strong>no credentials</strong>, and makes <strong>no network requests</strong> — it only reads
      and displays local browser context to prove the redirect. See the repository README for the
      full advisory.
    </p>
  </div>

  <script>
    // Read-only: display local browser context only.
    // No network requests, no storage, no input collection, no exfiltration.
    document.getElementById('loc').textContent = String(document.location && document.location.href);
    document.getElementById('ref').textContent = document.referrer || '(none)';
    document.getElementById('ua').textContent  = navigator.userAgent || '(unknown)';
    document.getElementById('ts').textContent  = new Date().toISOString();
  </script>
</body>
</html>