PT-2026-43381 · Undefined · Undefined

CVE-2025-68709 · Published 2026-05-26 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Medium

Base vector

AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SailingLab AppLock version 4.3.8

Description A local attacker can trigger arbitrary JavaScript execution through the BrowserMainActivity component. This occurs because the component accepts VIEW intents containing javascript: URIs, creating an unsafe navigation path. This flaw may lead to privilege escalation or UI spoofing, where the application interface is manipulated to deceive the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-68709

Affected Products

Undefined

References · 4

• 🔥 https://github.com/actuator/com.alpha.applock/blob/main/CVE-2025-68709 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-68709 · Security Note
• https://play.google.com/store/apps/details?id=com.alpha.applock · Note
• https://github.com/actuator/com.alpha.applock · Note