EcoOnline EHS (Android) — Deep Link Validation Bypass → WebView Open Redirect (CVE-2026-26897)

Public disclosure / advisory for CVE-2026-26897, a deep link validation bypass in the EcoOnline EHS Android application (com.airsweb.v10). A crafted ehs-app:// deep link is rewritten to https:// and loaded directly into the app's main WebView without the host allow-list check that the app applies on every other navigation path, letting a remote attacker render arbitrary attacker-controlled content inside the trusted application (phishing).

Responsibly disclosed, acknowledged by the vendor, and fixed in version 0.2.500.

✅ Status: FIXED

• Vulnerable version analysed: com.airsweb.v10 0.2.499 (versionCode 44631)
• Fixed version: 0.2.500 (live on Google Play)
• Action for users: update the EcoOnline EHS app to the latest version.

Affected binary (for verification)

The vendor's application is proprietary and is not redistributed in this repository. The static analysis below was performed on the build identified here — obtain the exact APK from an archive (e.g. APKPure version history) and verify its hash before reproducing:

Summary

Description

EcoOnline EHS for Android is a Jetpack-Compose WebView wrapper around the EHS web platform. Its default content is loaded from:

startUrl = "https://ehsmobilelanding.ecoonline.net/"

The app exports a single Activity (MainActivity) that is both the launcher and the handler for the custom URL scheme ehs-app. The <data> element of the deep-link intent-filter declares only a scheme — no host and no path — so any ehs-app://… URI is routed to the app.

To protect WebView navigation, the app implements a host allow-list (isInternalHost) and applies it when restoring the last-visited URL. However, the deep-link handling branch does not call that allow-list at all. It takes the incoming deep-link URI, performs a naïve string replacement of the scheme ehs-app: → https:, and calls WebView.loadUrl() on the result. A remote attacker can therefore craft a deep link that causes the trusted app to load an arbitrary https:// origin.

Affected component

AndroidManifest.xml (v0.2.499) — exported, scheme-only deep link

<activity
    android:name="com.airsweb.v10.MainActivity"
    android:exported="true" ... >
    <intent-filter>
        <action android:name="android.intent.action.MAIN"/>
        <category android:name="android.intent.category.LAUNCHER"/>
    </intent-filter>
    <intent-filter>
        <action android:name="android.intent.action.VIEW"/>
        <category android:name="android.intent.category.DEFAULT"/>
        <category android:name="android.intent.category.BROWSABLE"/>
        <data android:scheme="ehs-app"/>   <!-- scheme only: no host, no path -->
    </intent-filter>
</activity>

Root cause — deep-link branch in MainActivityKt.WebViewPage (decompiled, v0.2.499)

// intent delivered to the exported MainActivity
if (intent.getScheme().equals("ehs-app")) {
    WebView webView = ...;
    if (webView != null) {
        Uri data = intent.getData();                       // full ehs-app://… URI
        String s = String.valueOf(data);
        // naïve scheme rewrite: "ehs-app:" -> "https:"
        String url = StringsKt.replaceFirst(s, "ehs-app:", "https:", false, 4, null);
        webView.loadUrl(url);                              // <-- NO isInternalHost() CHECK
    }
}

The allow-list that this path fails to apply (used elsewhere in the same file):

private static final Regex internalDomains =
        new Regex("^[-\\w]*\\.(airsweb)|(ecoonline)\\.net");
private static final List<String> excludeDomainsStartingWith =
        listOf("passport", "login", "auth");

public static boolean isInternalHost(String host) {
    for (String p : excludeDomainsStartingWith)
        if (host.startsWith(p)) return false;
    return internalDomains.containsMatchIn(host);
}

Secondary note: the internalDomains regex is itself weak (broken alternation + containsMatchIn substring matching), but the primary issue is that the deep-link branch never invokes isInternalHost at all.

Proof of Concept

A screen-recording PoC was produced on 2026-01-13 against com.airsweb.v10 0.2.499.

1. Install the affected version (0.2.499) on an Android device.
2. Deliver a crafted deep link to the victim (e.g. via email, SMS, chat, QR, or a web page):
   root@kitploit:~

   ehs-app://attacker.example/login
   

3. When the victim opens it, MainActivity rewrites the scheme and the WebView loads:
   root@kitploit:~

   https://attacker.example/login
   

   inside the trusted EcoOnline EHS app — no allow-list check is performed.
4. The attacker page is rendered with the look and chrome of the legitimate app and can, for example, present a fake EHS login to harvest credentials.

A benign, non-harvesting demonstration of the redirect is included in poc/redirect-proof.html (usage: poc/README.md). It proves an arbitrary origin is loaded inside the trusted app, with no inputs, no credential capture, and no network requests.

In the original PoC the researcher hosted a benign look-alike landing page purely to demonstrate the redirect. This advisory documents the vulnerability for defensive / disclosure purposes and intentionally contains no phishing page or credential-capture code.

Impact

• Loads arbitrary attacker-controlled https:// content inside the trusted application context.
• Phishing / credential theft via a login prompt that appears to originate from the real app.
• UI spoofing and general social-engineering uplift (the malicious page inherits the app's trust).

CVSS v3.1 (researcher estimate — finalise before publication): AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N → 6.3 (Medium) (a Scope:Changed argument can be made, as untrusted content executes in the trusted app context).

Remediation

Update to com.airsweb.v10 0.2.500 or later. Recommended fixes:

• Apply isInternalHost() (or an equivalent allow-list) to deep-link URLs before loadUrl().
• Do not derive the loaded URL by blindly rewriting the scheme; validate scheme and host.
• Constrain the deep-link intent-filter with an explicit android:host/android:pathPrefix.
• Strengthen the internalDomains regex (anchor host fully; avoid substring matches).

Disclosure timeline

References

• CVE-2026-26897 (MITRE CVE record)
• EcoOnline EHS on Google Play — https://play.google.com/store/apps/details?id=com.airsweb.v10
• Vendor — https://www.ecoonline.com/

Credit

Discovered and reported by Ahmet Mersin — GitHub @iwallplace, HackerOne iwallplace.