CVE-2025-68712

Vulnerability

SpSoft AppLock (com.sp.protector.free) version 7.9.40 integrates Android's biometric authentication but implements a custom overlay for the lock screen. The overlay fails to consistently enforce authentication after being dismissed, allowing the lock interface to be bypassed. The vulnerability is reachable when the app is configured to protect other applications (e.g., Chrome) and the device is in an unlocked state after initial authentication. [1][2]

Exploitation

An attacker with physical access to the device can navigate through cascading interface flows, such as exposed routes triggered by advertisement or browser intents, to exit the lock interface without re-authentication. This does not require elevated privileges or prior knowledge of the user's PIN or fingerprint. [2]

Impact

Successful exploitation allows the attacker to access protected apps (e.g., Chrome) without authentication, leading to information disclosure of sensitive data stored within those apps. The attacker also gains unauthorized privilege escalation by bypassing the app's security controls. [1][2]

Mitigation

As of the publication date, no official fix has been released by SpSoft. Users should consider using alternative app lockers or monitor the Google Play Store for updates to version 7.9.40. The app is not listed on the CISA KEV. [1][2]