Bundle Report

com-x8bit-bitwarden v2026.5.1

Bundle risk37low

Binary-only · L1Live analyzer output · not mock dataAnalyzed just now

v2026.5.1build 21675low· 37

926732e76020339ff45fe0f2b29a2fb05c94e75eb9071744ec6621fb5abf6b8d

Platform: Android · APK
Bundle size: 77.5 MB
OS range: Android API 29 → Android API 37
Architectures: arm64-v8a, armeabi-v7a, x86, x86_64
Permissions: 14

Store review readiness

Expected to pass review

All known pre-review checks pass.

Submit. All known pre-review checks pass. Reviewer may still raise non-static-analysis concerns (screenshots, metadata, UX) — those are out of scope here.

Blocking0

No pre-review rejection causes

None detected

Needs review0

No reviewer-flag items

None detected

OK4

What was checked and passed

Data Safety form covers SDK-collected data categories
Data Safety form covers third-party sharing
No version-confirmed CVEs against bundled SDKs
Static surface clusters with labeled-clean corpus neighbors· corpus k-NN bad-neighbor weight 0.00 (low)

16 findings

Historical CVE on SDK (build version not detected): GsonSDK vulnerability · info
GHSA-4jrv-ppp4-jm57 — Deserialization of Untrusted Data in Gson
component: gson
Historical CVE on SDK (build version not detected): RetrofitSDK vulnerability · info
GHSA-8p8g-f9vg-r7xr — Directory Traversal vulnerability in Square Retrofit
component: retrofit
Historical CVE on SDK (build version not detected): RetrofitSDK vulnerability · info
GHSA-j379-9jr9-w5cq — XML External Entity (XXE) vulnerability in Square Retrofit
component: retrofit
Exported Android componentExported component · info
com.x8bit.bitwarden.AutofillCallbackActivity (activity)
Exported Android componentExported component · info
com.x8bit.bitwarden.AuthCallbackActivity (activity)
Exported Android componentExported component · info
com.x8bit.bitwarden.MainActivity (activity)
Exported Android componentExported component · info
com.x8bit.bitwarden.Autofill.CredentialProviderService (service)
Exported Android componentExported component · info
com.x8bit.bitwarden.AutofillTileService (service)
Exported Android componentExported component · info
com.x8bit.bitwarden.data.platform.service.AuthenticatorBridgeService (service)
Exported Android componentExported component · info
com.x8bit.bitwarden.Accessibility.AccessibilityService (service)
Exported Android componentExported component · info
com.x8bit.bitwarden.GeneratorTileService (service)
Exported Android componentExported component · info
androidx.work.impl.background.systemjob.SystemJobService (service)
Exported Android componentExported component · info
com.x8bit.bitwarden.MyVaultTileService (service)
Exported Android componentExported component · info
com.x8bit.bitwarden.Autofill.AutofillService (service)
Exported Android componentExported component · info
androidx.profileinstaller.ProfileInstallReceiver (receiver)
Exported Android componentExported component · info
androidx.work.impl.diagnostics.DiagnosticsReceiver (receiver)

Want PR-level context for this app?

Connect the GitHub repo for this app to upgrade to L3. You'll get per-PR Check Runs, source-aware risk factors, and root-cause attribution against this exact bundle.

Compare tiers