RoboForm Password Manager CVE-2026-47782

Exploitation requires a malicious Android application to be installed and active on the same physical device as the vulnerable RoboForm Password Manager - the CVSS vector AV:L confirms the attack is device-local, not network-reachable. The CVSS modifier UI:A (active user interaction required) indicates some user-initiated action must occur to trigger the malicious Intent dispatch; the exact interaction type (e.g., opening the malicious app, tapping a UI element) is not specified in the available data but is required. No authentication to RoboForm itself is needed by the attacker (PR:N), but the attacker's malicious app must already be present on the device. Exploitation is limited by: the need for a co-installed malicious application, mandatory user interaction, local-only attack surface (cannot be triggered remotely), and a low integrity impact ceiling (VI:L) with no direct confidentiality impact on the vulnerable system component as scored. Non-default conditions that enable the attack include the presence of a sideloaded or otherwise untrusted application on the device.

The CVSS 4.0 score of 4.6 (Medium) with vector AV:L/AC:L/AT:N/PR:N/UI:A reflects two meaningful constraints: local attack vector and required active user interaction. AV:L confirms the attacker cannot reach this over a network - a co-installed malicious app is required, which itself assumes a prior compromise or social engineering step. UI:A further limits opportunistic at-scale exploitation. Integrity impact is rated Low (VI:L) with no confidentiality impact on the vulnerable system component itself, though the 'Information Disclosure' tag in the intelligence feed and the silent download behavior suggest secondary risk: downloaded files could be used as staging material for follow-on local exploitation. No EPSS score was provided in the available data, preventing quantitative exploitation-probability comparison. No CISA KEV listing and no identified POC code corroborate the assessment that this is not currently being actively exploited at scale. The primary real-world concern is targeted attack scenarios involving a malicious companion app, not mass exploitation. The sensitivity of the affected product - a password manager storing credentials - elevates the consequence if exploitation is chained with other techniques.

A malicious Android application - delivered via sideloading or a deceptive Play Store listing - is installed on the same device as RoboForm Password Manager. When the user interacts with the malicious app (satisfying the UI:A requirement), it dispatches a crafted Android Intent to RoboForm containing a URL pointing to attacker-controlled infrastructure. RoboForm silently fetches the URL and writes the downloaded payload to device storage with no prompt, dialog, or notification visible to the user, potentially staging a file for a subsequent local privilege escalation or exfiltrating device context through the outbound HTTP request metadata. No public POC code has been identified at time of analysis.