SailingLab AppLock CVE-2025-68709
MEDIUMSeverity by source
AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker to trigger arbitrary JavaScript execution via BrowserMainActivity, which accepts VIEW intents with javascript: URIs. This unsafe navigation path results in script execution and may allow UI spoofing or privilege escalation.
AnalysisAI
Arbitrary JavaScript execution in SailingLab AppLock 4.3.8 for Android is triggered by a malicious co-installed app sending a crafted VIEW intent with a javascript: URI to the exposed BrowserMainActivity component. Because AppLock operates with elevated permissions by design (it restricts access to other apps), this unsafe WebView navigation path creates a changed-scope impact: script execution occurs within AppLock's privilege context, enabling UI spoofing and potential privilege escalation beyond what a normal app could achieve. No public exploit identified at time of analysis beyond the publicly available proof-of-concept published by the reporter on GitHub.
Technical ContextAI
The vulnerability resides in BrowserMainActivity, an exported Android Activity component within com.alpha.applock (SailingLab AppLock 4.3.8). Android Activities that handle implicit VIEW intents without validating the URI scheme can be abused by any co-installed app to pass javascript: URIs directly into a WebView renderer. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting), manifesting in a native Android context rather than a traditional browser. The absence of javascript: scheme filtering in the Activity's intent handling is the root cause. The CVSS vector AV:A reflects the Android inter-app attack surface - a co-resident malicious application can send intents across the adjacency boundary without requiring network access. The CPE entry is unspecified (cpe:2.3:a:n/a:n/a), meaning NVD has not yet assigned a formal CPE string; affected product identity is confirmed via the package name com.alpha.applock on Google Play.
RemediationAI
No vendor-released patch has been identified at time of analysis. The reporter's GitHub advisory at https://github.com/actuator/com.alpha.applock/blob/main/CVE-2025-68709 documents the issue, but no corresponding patched release version is referenced. Users should monitor the Google Play Store listing for an updated version of com.alpha.applock that addresses javascript: URI handling in BrowserMainActivity. As a compensating control, device administrators can use Android Enterprise or MDM policies to restrict sideloading of unknown applications, reducing the risk of a co-installed malicious app being present to send the malicious intent. Disabling the AppLock application entirely eliminates the attack surface at the cost of losing app-locking functionality. Developers should remediate by validating and filtering URI schemes in BrowserMainActivity's intent handler, explicitly rejecting javascript:, data:, and other non-http(s) schemes before passing URIs to a WebView. Adding android:exported="false" to BrowserMainActivity in the manifest, if external intent handling is not required, would eliminate the attack vector entirely.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today