CVE-2026-47782 describes a vulnerability in the RoboForm Password Manager Android app where the app processes Android intents containing URLs without sufficient validation or user interaction. This can lead to the app silently downloading files from potentially malicious web pages without notifying or confirming with the user. The affected versions include 9.8.6.3 and earlier. The CVSS 3.0 vector indicates local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability allows an attacker to cause the RoboForm app to download files silently from malicious URLs passed via intents. While this does not directly compromise confidentiality or availability, it may lead to limited integrity issues such as unwanted or malicious files being downloaded without user awareness. There are no known active exploits, and the overall severity is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with intents or links that may trigger RoboForm to download files. Avoid opening untrusted URLs or intents that could invoke RoboForm. Monitor vendor communications for updates or patches addressing this issue.