An OS command injection vulnerability in Root Browser Classic 3.3.0 allows attackers to execute arbitrary commands by supplying a maliciously crafted SQLite database filename.

The application improperly neutralizes special elements when passing the path of a selected SQLite database to the operating system shell. An attacker can leverage this to inject arbitrary OS commands by creating or renaming a database file with a crafted malicious filename.

This vulnerability carries a CVSS score of 8.5, reflecting its potential for complete system compromise. Successful exploitation allows an attacker to execute arbitrary code with the privileges of the application, which could lead to full device compromise, data theft, or unauthorized access to sensitive local files.

Immediate Action: Review the vendor advisory at https://fluidattacks.com/advisories/infant and apply all available security updates or patches provided by Maple Media.

Proactive Monitoring: Monitor device logs for unusual shell process executions or unexpected file system modifications originating from the Root Browser application.

Compensating Controls: Avoid opening unknown or untrusted SQLite database files within the application until a security update is applied.

Public Exploit Available: No

Given the potential for remote or local command execution, users should treat this vulnerability with high urgency. If an official patch is currently unavailable, users should exercise extreme caution by not opening database files from untrusted sources until the software is updated.