RoboForm Password Manager

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension presents itself as RoboForm Password Manager at version 10.0.1.1. The medium-severity findings are four network calls, NET-FETCH-1.js-10210, NET-FETCH-content.js-462, NET-FETCH-main.js-1709 and NET-FETCH-main.js-2419, and one obfuscation hit, OBFUSCATION-large_base64 at main.js:0. No malware signature, network IoC, credential-theft rule, secret leak or tool-poisoning finding is present. For a password manager, that absence is the strongest signal in the scan, because code that would steal logins or send cookies out would normally trip at least one of those categories.

content.js is a natural home for autofill logic, and a fetch there can be the page script asking the background service for form data. main.js holds the background bundle. The two NET-FETCH-main.js sites at lines 1709 and 2419 are ordinary fetch call sites in that bundle. The scan gives no destination host for any of the four calls, so they cannot be tied to an unknown endpoint. That missing detail is a limit, though the file locations fit autofill and sync traffic.

The OBFUSCATION-large_base64 hit at main.js:0 is a single embedded base64 blob. Bundled extensions often carry inline icons, translation tables, public keys or library assets as base64. The dangerous version of this pattern is a decoder and a packed payload in the same file, and the scan does not report that pairing. Nothing in the medium findings shows history API rewriting, a custom search domain, a new tab replacement or cookie exfiltration.

A skeptic can point to the empty developer name and the empty permission list. A password manager that declares no host permissions in the scan either had its manifest fields missed by extraction or is not the official package. That is a real gap, and it keeps this from being a clean confirmation. The way to close it is to compare the Edge package at version 10.0.1.1 with the official RoboForm build and check the manifest for form-fill host access plus the expected sync endpoints. The name itself shows no Cyrillic substitution, no lookalike spelling and no conflicting brand claim. The generic fetch and base64 findings supply no behavior that a password manager would not need.

On the current evidence, the scan captured normal bundle mechanics. The remaining uncertainty is publisher metadata, not code behavior. A specific unknown host, a decoder paired with the base64 blob, or any credential-shaped rule match would change this assessment. None of those are present.

Key Reasons

• No malware, IoC, credential-theft, secret or tool-poisoning findings in a password manager that would normally trip those rules if it were malicious.
• The four NET-FETCH findings in 1.js, content.js and main.js match ordinary autofill and sync calls.
• OBFUSCATION-large_base64 at main.js:0 is a single embedded blob, with no decoder or packed payload reported alongside it.
• The name uses the exact RoboForm product name with no Cyrillic substitution or lookalike spelling.
• The developer name and permission list are empty, so publisher attribution remains unconfirmed.

False Positive Considerations

• NET-FETCH rules firing on bundled autofill and sync code
• OBFUSCATION-large_base64 matching embedded bundle assets
• Minified JavaScript treated as obfuscation
• Empty publisher and permission metadata from store extraction

Reviewed 2026-10-19; recommended action: suppress false positive; model confidence 85%.