SailingLab AppLock (com.alpha.applock) implements its PIN lock as a screen overlay instead of using Android’s secure authentication APIs, creating an authentication bypass weakness (CWE‑288). A local attacker who has physical access to the device can navigate the app’s interface, exploiting exposed routes and advertisement or browser intents. This allows the attacker to bypass the lockscreen verification and gain access to protected applications such as Chrome, resulting in information disclosure and privilege escalation.

The vulnerability affects SailingLab’s AppLock version 4.3.8 on Android devices. No other versions or vendor details are available in the current data set.

Exploitation requires only local, physical access to the device. The CVSS score is 2.4, and the EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. Therefore, the real‑world exploitation likelihood is uncertain but possible under the described local conditions.