This page was loaded inside the trusted EcoOnline EHS application's WebView
via an unvalidated ehs-app:// deep link. The deep-link handler
rewrites the scheme to https: and calls WebView.loadUrl() without
applying the app's host allow-list (isInternalHost()), so an attacker-chosen origin
is rendered with the look and trust of the legitimate app.
In a real attack this slot would hold a spoofed login or other social-engineering content. This demonstration page does none of that.
Benign security-research PoC for a fixed vulnerability (patched in com.airsweb.v10 0.2.500). It has no input fields, captures no credentials, and makes no network requests — it only reads and displays local browser context to prove the redirect. See the repository README for the full advisory.