SpSoft AppLock CVE-2025-68712

Physical access to the target Android device is required - this is an AV:L (local) attack with no network exploitation path. The attacker must have low-level access to the device (PR:L per CVSS), meaning a standard unlocked session or brief hands-on access; root or elevated privileges are not required. SpSoft AppLock version 7.9.40 must be installed and actively locking one or more applications on the device. The bypass is triggered specifically via advertisement or browser Intents that expose navigable routes within the AppLock overlay UI - the application's in-app advertisement functionality or external browser intent handling must be reachable during the attack. No user interaction from the device owner is needed once the attacker has physical control. Exploitation is limited by: physical access as a hard prerequisite (eliminates all remote and network-based attack scenarios), the need for the lock overlay to be active on a target app at time of access, and the requirement that the advertisement or browser intent pathway is reachable in the device's current state.

The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the bounded but real risk of this vulnerability. The attack vector is local (AV:L), requiring physical access to the device, which substantially limits the realistic attacker population to theft scenarios, domestic abuse contexts, or unauthorized access by someone temporarily in possession of an unlocked device. The low attack complexity (AC:L) and no required user interaction (UI:N) mean that once physical access is obtained, the bypass is straightforward with no race conditions or environmental dependencies. The confidentiality impact is high (C:H) since access to protected apps may expose private messages, credentials, or personal data. Integrity and availability are unaffected (I:N/A:N). The EPSS score of 0.04% at the 11th percentile is consistent with a niche, physical-access-only attack with no network exploitation path - this is not a remotely mass-exploitable issue. A researcher-published proof-of-concept exists on GitHub (actuator/com.sp.protector.free), which lowers the skill barrier for a motivated local attacker. The CVE is not listed in CISA KEV, and no evidence of active or widespread exploitation is present in the available data. Real-world priority is LOW for most enterprise environments but MODERATE for high-risk personal device scenarios (shared devices, domestic threat models). The PR:L vector indicates low-privilege requirements; this does not require root or any elevated Android permissions - a standard user session is sufficient.

An attacker with brief physical access to an Android device running SpSoft AppLock 7.9.40 navigates to a locked application, waits for or triggers an in-app advertisement or crafts a browser-originated Intent that initiates a UI transition within the AppLock overlay. By following the cascading interface flow through the exposed route, the attacker exits the lock overlay without being prompted for fingerprint or PIN, gaining direct access to the previously locked application (e.g., Chrome) and the sensitive data within. A researcher-published proof-of-concept on GitHub documents this navigation sequence, lowering the technical bar for exploitation.