CVE-2025-68709

MediumCVSS 5.2

Published: 26/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

SailingLab AppLock (com.alpha.applock) version 4.3.8 for Android allows a local attacker to execute arbitrary JavaScript via BrowserMainActivity, which accepts VIEW intents with javascript: URIs. This may lead to UI spoofing and privilege escalation.

Risk Assessment

A local attacker can execute arbitrary JavaScript in the app's context, potentially leading to data theft and privilege escalation.

Recommendation

Update the app to the latest version and restrict acceptance of VIEW intents with javascript: URIs.

Other vulnerabilities in SailingLab AppLock

CVE-2025-68708Low
SailingLab AppLock for Android version 4.3.8 implements the PIN lock as an overlay rather than using Android's secure authentication APIs. A local attacker with physical access can bypass the lock screen by navigating cascading interfaces or using advertisement/browser intents, gaining access to protected apps like Chrome.

Original NVD description (English source)

SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker to trigger arbitrary JavaScript execution via BrowserMainActivity, which accepts VIEW intents with javascript: URIs. This unsafe navigation path results in script execution and may allow UI spoofing or privilege escalation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS