CVE-2025-68708
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
SailingLab AppLock for Android version 4.3.8 implements the PIN lock as an overlay rather than using Android's secure authentication APIs. A local attacker with physical access can bypass the lock screen by navigating cascading interfaces or using advertisement/browser intents, gaining access to protected apps like Chrome.
Risk Assessment
The risk involves information disclosure and privilege escalation, as an attacker can access protected apps and data without knowing the PIN.
Recommendation
Immediately update the app to a version that uses Android's secure authentication mechanisms, or replace it with an alternative solution.
Original NVD description (English source)
SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents - an attacker can evade lockscreen verification and access protected apps (e.g., Chrome). This results in information disclosure and privilege escalation.