External risk intelligence

EcoOnline EHS Android Manifest Information Disclosure and Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-26897

The vulnerability affects a specific Android mobile application. Mobile apps are client-side software on individual devices, not public-facing servers or internet-exposed services. The component-based attack surface within an AndroidManifest is local to the device environment, making public internet exposure as a service or network appliance very unlikely.

Information Disclosure

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical security vulnerability found in a specific version of the EcoOnline EHS Android application that could allow remote attackers to access sensitive information and execute unauthorized code. While the direct exposure of this mobile application to external threats is unlikely, its presence and use within your organization warrant a review to confirm relevance and identify any potential risks.

Sensitive data and code can be compromised.
Critical vulnerability in a widely used app.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

A remote attacker can target the EcoOnline EHS Android application by leveraging a flaw in its AndroidManifest.xml file. This vulnerability could allow an attacker to gain unauthorized access to sensitive information within the application and potentially execute arbitrary code on the affected device.

No authentication or user interaction required.
Exploits a flaw in AndroidManifest.xml.
Risk of sensitive data exposure and code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability in the EcoOnline EHS Android application could allow a remote attacker to access sensitive information and execute arbitrary code by exploiting a component within the application's AndroidManifest.xml file.

Sensitive application data and device functions could be at risk.
Exposure could happen via a specially crafted component.
Unauthorized code execution and data access may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The EcoOnline EHS Android application's remote code execution vulnerability likely impacts users and potentially the company's data if the application handles sensitive information. The first step is to identify all devices running this specific application, confirm its reachability and business criticality, and then assign ownership for remediation.

Application owners should manage this issue.
Verify application reachability and business criticality.
Plan remediation based on exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the EcoOnline EHS application?

EcoOnline EHS (com.airsweb.v10) is an Android mobile application designed to help organizations manage environment, health, and safety (EHS) tasks. It allows users to access workplace safety data, report incidents, or manage compliance records directly from their mobile devices.

What does CWE-200 mean for CVE-2026-26897?

CWE-200 refers to an Information Exposure weakness. In the context of this CVE, it means the application inadvertently reveals sensitive data that it should have kept private. This flaw, combined with the way components are defined in the AndroidManifest.xml, allows unauthorized access and potential code execution.

How is this vulnerability triggered?

The vulnerability is triggered by exploiting misconfigured components within the application's AndroidManifest.xml file. This process does not require the attacker to have special privileges or rely on a user to perform an action. Notably, this flaw is specific to the application's internal structure and is not triggered by standard web browsing or typical server-side network requests.

Is my organization at risk from this CVE?

According to Halo Surface Signal, this vulnerability is very unlikely to pose a broad network-based risk. Because it affects a client-side mobile application rather than a public-facing server, the attack surface is limited to the local device environment. You should primarily focus on devices where this specific app version is installed.

How should I respond to this threat?

Begin by auditing your mobile device inventory to locate all instances of the affected EcoOnline EHS version. Once identified, evaluate the business necessity of the app and determine if it handles sensitive corporate information. Coordinate with application owners to monitor for updates or transition to a secure version to mitigate potential data or device risks.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.