CVE-2026-26897

The EcoOnline EHS (com.airsweb.v10) Android application, version 0.2.499, contains a flaw rooted in its AndroidManifest.xml component that lets a remote attacker obtain sensitive information and execute arbitrary code. Because the issue is rated CVSS 9.8 with network access, low attack complexity, and no privileges or user interaction required, an attacker who can reach the affected component over the network can trigger it without tricking the user. Successful exploitation exposes sensitive data handled by the app and allows arbitrary code execution on the device running it. Affected users are employees and contractors running the EcoOnline EHS (Airsweb) Android app at the named version in enterprise EHS deployments. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.7% probability of exploitation within 30 days.

What to do: Inventory managed Android devices (via MDM/EMM) for the package com.airsweb.v10 and confirm whether version 0.2.499 is installed; update the app through Google Play/your enterprise app channel as soon as EcoOnline publishes a patched release, since no fixed version is specified in the available data. Until patching, consider removing or restricting the app for users who handle sensitive data, and monitor for EcoOnline advisories or updates to this record.