SecuriTricks - CVE-2025-68710

Description

Easyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents - an attacker can evade lockscreen verification and access protected apps (e.g., Chrome), resulting in information disclosure and privilege escalation.

Product(s) Impacted

Vendor	Product	Versions
Easyelife	App Lock	1.9.2

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-288

Authentication Bypass Using an Alternate Path or Channel

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	easyelife	app_lock	1.9.2	/	/	/	/	/	/	/

References

https://github.com/actuator/locker.app.safe.applocker

https://github.com/actuator/locker.app.safe.applocker/blob/main/CVE-2025-68710

https://play.google.com/store/apps/details?id=locker.app.safe.applocker

CVSS Score

2.4 / 10

CVSS Data - 3.1

Attack Vector: PHYSICAL
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: NONE
Availability Impact: NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

View Vector String

Timeline

Published: May 26, 2026, 8:16 p.m.
Last Modified: May 27, 2026, 9:16 p.m.

Status : Deferred

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2025-68710