CVE-2026-85082
Received Received - Intake

Root Browser Classic 3.3.0 Command Injection

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: Fluid Attacks

Description
Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-85082
EUVD
EUVD-2026-86482

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
maple_media root_browser_classic 3.3.0
maple_media root_browser_classic 3.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85082 is an OS command injection flaw in Root Browser Classic versions 3.3.0 and 3.4.0. When processing filenames of SQLite database files, the app fails to properly escape shell characters. Attackers can craft filenames with shell syntax like $(command) which executes when a user browses to the file. The vulnerability occurs in SqliteHelper#getTables() where filenames are concatenated into shell commands without sanitization.

Detection Guidance

Check for files with suspicious names containing shell syntax like $(command) in directories browsed by Root Browser Classic. Look for unexpected command executions in system logs or app logs. Monitor for unauthorized file access or modifications in shared storage if MANAGE_EXTERNAL_STORAGE is enabled.

Impact Analysis

Exploitation allows arbitrary command execution with the app's user permissions. This could lead to accessing or modifying private files, shared storage if permissions are granted, or exfiltrating data. The attacker needs the victim to navigate to a directory containing the malicious file, making it a local attack requiring user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate GDPR's data protection principles if personal data is exposed or HIPAA's security rules if protected health information is compromised. The arbitrary command execution risk increases the likelihood of data breaches, potentially resulting in non-compliance with these regulations.

Mitigation Strategies

Uninstall Root Browser Classic immediately. Avoid using the app until a patch is released. Restrict file access permissions and review app permissions in Android settings. Monitor for unusual activity in system logs or file changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85082. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart