Root Browser Classic CVE-2026-85082

Exploitation requires that the victim open, within Root Browser Classic 3.3.0, a SQLite database file whose filename the attacker controls and has seeded with shell metacharacters; the app then passes that path to an OS shell without escaping (CWE-78). Limiting factors: the attack vector is LOCAL (the file must reach the device - e.g. via download, sideload, shared storage, or another app), and it requires passive user interaction (the victim must select/open the file). It is confined to users of this specific rooted-Android file manager, so the realistic attack surface is narrow despite the high impact.

This is a genuine but access-constrained flaw whose raw score overstates remote danger. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, 8.5) correctly encodes LOCAL attack vector plus PASSIVE user interaction - meaning exploitation is not remote/network-borne; an attacker must get a malicious file onto the device and induce the victim to open it in the app. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this is 'no public exploit identified at time of analysis.' The high VC/VI/VA is plausible because Root Browser Classic is a ROOT file manager that shells out, so injected commands may run with elevated privilege. Bottom line: real technical impact is high (potential command execution, likely root), but the local vector + required user interaction + niche Android app footprint make this a targeted/low-likelihood issue rather than a mass-exploitation priority. Note UI:P (passive) in the 4.0 vector maps to UI:R in 3.1 - the victim must open the crafted database, which meaningfully limits realistic attack rate.

An attacker crafts a SQLite database file whose filename embeds shell metacharacters (e.g. a name containing '; ' or backticks). The victim, using Root Browser Classic 3.3.0, taps to open the malicious .db file; the app concatenates the filename into an OS shell command, and the injected commands execute - likely with the app's elevated/root privileges. No public exploit code is currently identified, and the local vector plus required user interaction make this a targeted rather than opportunistic attack.