CVE-2026-47782
RoboForm Password Manager Intent URL Handling Flaw
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| siber_systems | roboform_password_manager | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-357 | The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Android app "RoboForm Password Manager" by Siber Systems, Inc. The app handles Android intents without properly validating URLs, nor does it require user confirmation or provide notification. This means that if a malicious URL is passed to the app through an intent, RoboForm may silently download files without the user's knowledge or consent.
How can this vulnerability impact me? :
This vulnerability can lead to the app downloading potentially malicious files without user awareness or approval. This silent download could expose the user to malware, unwanted software, or other security risks, potentially compromising the device or user data.