CVE-2025-68708: AppLock Auth Bypass Vulnerability

CVE-2025-68708 Overview

CVE-2025-68708 affects SailingLab AppLock (com.alpha.applock) version 4.3.8 for Android. The application implements PIN-based app locking as a UI overlay rather than using Android's secure authentication APIs. A local attacker with physical access to an unlocked device can bypass the PIN screen by triggering cascading interface navigation through advertisement or browser intents. This evasion grants access to protected applications such as Chrome, resulting in information disclosure and limited privilege escalation within the locked app context. The flaw maps to [CWE-288: Authentication Bypass Using an Alternate Path or Channel].

Critical Impact
Physical-access attackers can bypass the AppLock PIN and reach protected applications, exposing user data stored within those apps.

Affected Products

SailingLab AppLock (com.alpha.applock) version 4.3.8 for Android
Distribution channel: Google Play Store
Platform: Android devices with AppLock installed

Discovery Timeline

2026-05-26 - CVE-2025-68708 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2025-68708

Vulnerability Analysis

AppLock 4.3.8 enforces its PIN gate by drawing an overlay window on top of the target application when a user attempts to launch it. The overlay is a presentation layer only. It does not leverage Android's BiometricPrompt, KeyguardManager, or the Keystore-backed authentication framework. Because the underlying activity continues to run behind the overlay, any alternate navigation path that brings the activity to the foreground while suppressing the overlay defeats the lock.

The vulnerability allows an attacker to launch protected applications through implicit intents originating from advertisements, browser links, or other foreground apps. These intent flows resolve directly to the target activity and do not transit through AppLock's gating logic. The exploitation flow requires only physical access and basic interaction with the device, with no special privileges or user assistance needed beyond device unlock.

Root Cause

The root cause is the use of a UI overlay as a security boundary instead of a system-level authentication primitive. The overlay relies on race conditions between activity launches and window draws. Exposed routes that resolve to protected activities through external intents are never mediated by the overlay, leaving the authentication check structurally bypassable.

Attack Vector

The attack requires local physical access to the device. An attacker opens a web page or advertisement that contains a deep link or intent resolving to a protected application. Tapping the link launches the target activity directly. AppLock's overlay either fails to render in time or is dismissed by the interface transition, leaving the protected application accessible without PIN entry. Refer to the GitHub CVE-2025-68708 advisory for the documented navigation flow.

Detection Methods for CVE-2025-68708

Indicators of Compromise

Presence of com.alpha.applock package version 4.3.8 installed on managed Android devices
Unexpected activity transitions from browser or advertisement apps directly into applications listed as protected by AppLock
Application launches from external intent sources bypassing the AppLock overlay activity in usagestats logs

Detection Strategies

Inventory managed Android endpoints for the com.alpha.applock package and flag installations at version 4.3.8 or earlier
Review Android UsageStatsManager data for foreground transitions that skip AppLock's gate activity before reaching protected apps
Correlate browser intent dispatches with subsequent foreground launches of high-value applications on the same device

Monitoring Recommendations

Enable Mobile Device Management (MDM) policies that report installed packages and versions to a central inventory
Forward Android event logs to a centralized analytics platform for cross-device correlation of intent-based app launches
Track Google Play Protect verdicts and advisory updates for com.alpha.applock

How to Mitigate CVE-2025-68708

Immediate Actions Required

Uninstall SailingLab AppLock 4.3.8 from managed Android devices until a vendor-patched version is published
Migrate sensitive applications behind Android's native protections such as work profiles, BiometricPrompt, or per-app authentication offered by the OS
Restrict physical access to unlocked devices and enforce strong device-level screen lock policies

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Monitor the SailingLab AppLock Google Play listing and the public CVE-2025-68708 advisory for updated builds that replace the overlay implementation with Android's secure authentication APIs.

Workarounds

Replace AppLock with a vendor solution that uses BiometricPrompt or Keystore-backed authentication for per-app locking
Use Android work profiles or multiple user profiles to isolate sensitive applications behind OS-level authentication
Disable browser handling of deep links for sensitive applications by clearing default intent associations in Android settings

bash

# Example: enumerate AppLock installations across enrolled Android devices via adb
adb shell pm list packages | grep com.alpha.applock
adb shell dumpsys package com.alpha.applock | grep versionName