SailingLab AppLock CVE-2025-68709
MEDIUMSeverity by source
AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker to trigger arbitrary JavaScript execution via BrowserMainActivity, which accepts VIEW intents with javascript: URIs. This unsafe navigation path results in script execution and may allow UI spoofing or privilege escalation.
AnalysisAI
Arbitrary JavaScript execution in SailingLab AppLock 4.3.8 for Android is triggered by a malicious co-installed app sending a crafted VIEW intent with a javascript: URI to the exposed BrowserMainActivity component. Because AppLock operates with elevated permissions by design (it restricts access to other apps), this unsafe WebView navigation path creates a changed-scope impact: script execution occurs within AppLock's privilege context, enabling UI spoofing and potential privilege escalation beyond what a normal app could achieve. No public exploit identified at time of analysis beyond the publicly available proof-of-concept published by the reporter on GitHub.
Technical ContextAI
The vulnerability resides in BrowserMainActivity, an exported Android Activity component within com.alpha.applock (SailingLab AppLock 4.3.8). Android Activities that handle implicit VIEW intents without validating the URI scheme can be abused by any co-installed app to pass javascript: URIs directly into a WebView renderer. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting), manifesting in a native Android context rather than a traditional browser. The absence of javascript: scheme filtering in the Activity's intent handling is the root cause. The CVSS vector AV:A reflects the Android inter-app attack surface - a co-resident malicious application can send intents across the adjacency boundary without requiring network access. The CPE entry is unspecified (cpe:2.3:a:n/a:n/a), meaning NVD has not yet assigned a formal CPE string; affected product identity is confirmed via the package name com.alpha.applock on Google Play.
RemediationAI
No vendor-released patch has been identified at time of analysis. The reporter's GitHub advisory at https://github.com/actuator/com.alpha.applock/blob/main/CVE-2025-68709 documents the issue, but no corresponding patched release version is referenced. Users should monitor the Google Play Store listing for an updated version of com.alpha.applock that addresses javascript: URI handling in BrowserMainActivity. As a compensating control, device administrators can use Android Enterprise or MDM policies to restrict sideloading of unknown applications, reducing the risk of a co-installed malicious app being present to send the malicious intent. Disabling the AppLock application entirely eliminates the attack surface at the cost of losing app-locking functionality. Developers should remediate by validating and filtering URI schemes in BrowserMainActivity's intent handler, explicitly rejecting javascript:, data:, and other non-http(s) schemes before passing URIs to a WebView. Adding android:exported="false" to BrowserMainActivity in the manifest, if external intent handling is not required, would eliminate the attack vector entirely.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today