AppLockZ CVE-2025-68711

Physical possession of the target Android device is the mandatory prerequisite (CVSS AV:P confirms this explicitly). The device must have AppLockZ 4.2.11 installed and actively configured with PIN lock enabled on at least one target application. No authentication is required from the attacker (PR:N per CVSS vector) - the bypass exploits a design flaw, not a credential weakness. Exploitation is further limited by: the device screen must be accessible to the attacker (i.e., the Android OS-level screen lock must already be bypassed or the device must be handed over in an unlocked state); the target protected app must be reachable via an advertisement SDK or browser intent, meaning not all AppLockZ-protected apps may be equally exposed. The vulnerability does not function remotely, cannot be triggered over a network, and has no impact on Android's native authentication layer.

The overall risk is low, supported by multiple converging signals. The CVSS base score is 2.4 (Low) with an attack vector of Physical (AV:P), meaning exploitation is gated by physical possession of the target device - a significant limiting factor in most threat models. The CVSS confidentiality impact is rated Low (C:L) with no integrity or availability impact, further bounding the blast radius. The EPSS score of 0.04% at the 11th percentile confirms near-zero observed exploitation activity in the wild. There is no CISA KEV listing. No verified CVE-specific POC is confirmed, though the researcher's GitHub repository (github.com/actuator/applock.passwordfingerprint.applockz) likely contains proof-of-concept material consistent with a research disclosure. The tags 'Privilege Escalation' and 'Information Disclosure' are technically accurate but should not inflate risk assessment - they apply within a narrow physical-access scenario. For enterprise environments where shared or kiosk devices run AppLockZ, risk may be elevated above the generic CVSS score; for typical personal devices, physical access implies the attacker already has meaningful control.

An attacker with brief unattended physical access to an Android device running AppLockZ 4.2.11 triggers a browser deep-link or advertisement intent that launches an exposed activity within a protected app, causing the AppLockZ overlay to be displaced or bypassed without prompting PIN or fingerprint verification. The attacker then accesses the previously locked app (such as Chrome with stored credentials or a banking app) and can read sensitive data. No network connectivity, special tools, or elevated privileges are required beyond physical possession of the unlocked device.