SailingLab AppLock CVE-2025-68709
MEDIUMCVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionNVD
SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker to trigger arbitrary JavaScript execution via BrowserMainActivity, which accepts VIEW intents with javascript: URIs. This unsafe navigation path results in script execution and may allow UI spoofing or privilege escalation.
AnalysisAI
Arbitrary JavaScript execution in SailingLab AppLock 4.3.8 for Android is triggered by a malicious co-installed app sending a crafted VIEW intent with a javascript: URI to the exposed BrowserMainActivity component. Because AppLock operates with elevated permissions by design (it restricts access to other apps), this unsafe WebView navigation path creates a changed-scope impact: script execution occurs within AppLock's privilege context, enabling UI spoofing and potential privilege escalation beyond what a normal app could achieve. No public exploit identified at time of analysis beyond the publicly available proof-of-concept published by the reporter on GitHub.
Technical ContextAI
The vulnerability resides in BrowserMainActivity, an exported Android Activity component within com.alpha.applock (SailingLab AppLock 4.3.8). Android Activities that handle implicit VIEW intents without validating the URI scheme can be abused by any co-installed app to pass javascript: URIs directly into a WebView renderer. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting), manifesting in a native Android context rather than a traditional browser. The absence of javascript: scheme filtering in the Activity's intent handling is the root cause. The CVSS vector AV:A reflects the Android inter-app attack surface - a co-resident malicious application can send intents across the adjacency boundary without requiring network access. The CPE entry is unspecified (cpe:2.3:a:n/a:n/a), meaning NVD has not yet assigned a formal CPE string; affected product identity is confirmed via the package name com.alpha.applock on Google Play.
RemediationAI
No vendor-released patch has been identified at time of analysis. The reporter's GitHub advisory at https://github.com/actuator/com.alpha.applock/blob/main/CVE-2025-68709 documents the issue, but no corresponding patched release version is referenced. Users should monitor the Google Play Store listing for an updated version of com.alpha.applock that addresses javascript: URI handling in BrowserMainActivity. As a compensating control, device administrators can use Android Enterprise or MDM policies to restrict sideloading of unknown applications, reducing the risk of a co-installed malicious app being present to send the malicious intent. Disabling the AppLock application entirely eliminates the attack surface at the cost of losing app-locking functionality. Developers should remediate by validating and filtering URI schemes in BrowserMainActivity's intent handler, explicitly rejecting javascript:, data:, and other non-http(s) schemes before passing URIs to a WebView. Adding android:exported="false" to BrowserMainActivity in the manifest, if external intent handling is not required, would eliminate the attack vector entirely.
More from same product – last 7 days
SQL injection in Open ISES Tickets before 3.44.2 allows attackers controlling or impersonating an InstaMapper or Google
SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config
TLS certificate verification bypass in Open ISES Tickets before 3.44.2 allows network-positioned attackers to intercept
Hardcoded Google Maps API key exposure in Open ISES Tickets before v3.44.2 enables any party with read access to the pub
Open ISES Tickets exposes a hardcoded Google Maps API key committed directly to its public GitHub source repository in t
Share
External POC / Exploit Code
Leaving vuln.today