Vulnerability-Lookup

JVNDB-2026-016626

Vulnerability from jvndb - Published: 2026-05-21 17:22 - Updated:2026-05-21 17:22

Severity

3.3 (Low) - cvssV3_0 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Summary

Android App "RoboForm Password Manager" insufficient validation of Android intents

Details

Android App "RoboForm Password Manager" provided by Siber Systems, Inc. accepts intents from other applications to open relevant web pages (e.g., login pages), but without sufficient URL validation, user confirmation nor notification.

Insufficient UI Warning of Dangerous Operations (CWE-357) - CVE-2026-47782
The CVSS vectors above assume that a victim user is directed to install some malicious app, and the app sends an intent to make RoboForm to download some files silently

Johan Francsics reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU93461473/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-47782
	Insufficient UI Warning of Dangerous Operations(CWE-357)	https://cwe.mitre.org/data/definitions/357.html

Impacted products

Vendor

Product

Siber Systems Inc.

RoboForm Password Manager

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-016626.html",
  "dc:date": "2026-05-21T17:22+09:00",
  "dcterms:issued": "2026-05-21T17:22+09:00",
  "dcterms:modified": "2026-05-21T17:22+09:00",
  "description": "Android App \"RoboForm Password Manager\" provided by Siber Systems, Inc. accepts intents from other applications to open relevant web pages (e.g., login pages), but without sufficient URL validation, user confirmation nor notification.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/357.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eInsufficient UI Warning of Dangerous Operations (CWE-357) - CVE-2026-47782\u003c/li\u003e\u003cli\u003eThe CVSS vectors above assume that a victim user is directed to install some malicious app, and the app sends an intent to make RoboForm to download some files silently\u003c/li\u003e\u003c/ul\u003eJohan Francsics reported this vulnerability to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-016626.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:siber_systems_roboform_password",
    "@product": "RoboForm Password Manager",
    "@vendor": "Siber Systems Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "3.3",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-016626",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU93461473/index.html",
      "@id": "JVNVU#93461473",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-47782",
      "@id": "CVE-2026-47782",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/357.html",
      "@id": "CWE-357",
      "@title": "Insufficient UI Warning of Dangerous Operations(CWE-357)"
    }
  ],
  "title": "Android App \"RoboForm Password Manager\" insufficient validation of Android intents"
}

CVE-2026-47782 (GCVE-0-2026-47782)

Vulnerability from cvelistv5 – Published: 2026-05-20 22:54 – Updated: 2026-05-21 12:48

Summary

Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handles Android intents without sufficient URL validation, user confirmation nor notification. If a URL to some malicious web page is given through an intent, RoboForm may silently download files without user confirmation nor notification.

Severity

3.3 (Low)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.6 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-357 - Insufficient UI warning of dangerous operations

Assigner

jpcert

References

3 references

URL	Tags
https://play.google.com/store/apps/details?id=com…
https://www.roboform.com/news-android
https://jvn.jp/en/vu/JVNVU93461473/

Impacted products

1 product

Vendor	Product	Version
Siber Systems, Inc.	Android App "RoboForm Password Manager"	Affected: 9.8.6.3 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47782",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-21T12:48:35.588068Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-21T12:48:42.996Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Android App \"RoboForm Password Manager\"",
          "vendor": "Siber Systems, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "9.8.6.3 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Android App \"RoboForm Password Manager\" provided by Siber Systems, Inc. handles Android intents without sufficient URL validation, user confirmation nor notification. If a URL to some malicious web page is given through an intent, RoboForm may silently download files without user confirmation nor notification."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-357",
              "description": "Insufficient UI warning of dangerous operations",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-20T22:54:20.562Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://play.google.com/store/apps/details?id=com.siber.roboform"
        },
        {
          "url": "https://www.roboform.com/news-android"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU93461473/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-47782",
    "datePublished": "2026-05-20T22:54:20.562Z",
    "dateReserved": "2026-05-20T00:15:29.626Z",
    "dateUpdated": "2026-05-21T12:48:42.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

JVNDB-2026-016626

CVE-2026-47782 (GCVE-0-2026-47782)

Tags

Sightings

Nomenclature