All issues reported in the security audit have been resolved except for the medium severity issue PRO-01-003 WP1, which unfortunately cannot be resolved at this time due to a platform limitation in Android (the Android operating system doesn’t currently provide the information that would be required to solve this issue). You can read the Proton Pass audit report(new window) for yourself. You can also find the audit reports for all Proton services.
The Android vulnerability is interesting, something to keep an eye on.
It’s the same reason why you shouldn’t enable autofill in any password manager, Bitwarden has autofill disabled as default because of interaction with untrusted iframes.
You need to keep the master key in memory when the manager is unlocked, there is no reason to keep the unencrypted passwords in memory. Seeing how the master key already is in memory, it doesn’t make a huge difference, but they could get swapped to disk.
Anyone that is able to scan the memory for the password or master key either has remote or local admin access to the system, and they would be able to install rootkits or similar malware.