VulnerabilityDeferred

CVE-2026-47782

If a URL to some malicious web page is given through an intent, RoboForm may silently download files without user confirmation nor notification.

MEDIUM 4.6EPSS 0.13%

Does this matter?

Lower severity and a low EPSS score (0.13%). Track it; it rarely justifies an emergency change on its own.

Description

Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handles Android intents without sufficient URL validation, user confirmation nor notification. If a URL to some malicious web page is given through an intent, RoboForm may silently download files without user confirmation nor notification.

CVSS 4.0: 4.6 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.13% probability · 3th percentile
CISA KEV: Not listed
Weakness: CWE-357
Source: vultures@jpcert.or.jp

References

https://jvn.jp/en/vu/JVNVU93461473/
https://play.google.com/store/apps/details?id=com.siber.roboform
https://www.roboform.com/news-android

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.