CVE-2025-68710

Vulnerability

Easyelife App lock (Fingerprint,Applock or locker.app.safe.applocker) version 1.9.2 for Android implements the PIN lock as an overlay instead of using Android's secure authentication APIs [1]. The app has insecure navigation through exposed routes, which allows an attacker to evade the lockscreen via advertisement or browser intents [2].

Exploitation

A local attacker with physical access to the device can trigger cascading interface flows, such as opening an advertisement or browser intent, to bypass the lockscreen verification [2]. This does not require authentication or special privileges beyond physical access.

Impact

Successful exploitation allows the attacker to access protected apps (e.g., Chrome) without entering the PIN, resulting in information disclosure and privilege escalation [2]. The attacker gains access to the same data and functionality as the legitimate user.

Mitigation

As of the publication date, no fixed version has been released. The vendor has not provided a workaround or patch. Users should be cautious about granting the app lock permissions and consider using alternative app lock solutions that leverage Android's secure authentication APIs [3].