CVE-2026-26897: n/a

This vulnerability affects the EcoOnline EHS Android application version 0.2.499. An attacker can exploit the AndroidManifest.xml component to remotely access sensitive information and execute arbitrary code on the device. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation can lead to full compromise of the affected Android application, including unauthorized disclosure of sensitive data and arbitrary code execution, potentially allowing complete control over the application or device functions related to it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting exposure by restricting network access to the application and monitoring for suspicious activity. Avoid installing or using the affected version if possible.