AppLockZ App Lock and Fingerprint Lock (version 4.2.11) contains a flaw that allows a local attacker with physical access to bypass the PIN lock. The application implements the lock as an overlay instead of relying on Android's secure authentication APIs, enabling the attacker to navigate exposed routes and evict lockscreen verification through advertisement or browser intents. This improper authentication weakness combined with insecure handling of intent resolution (CWE-288) permits an attacker to access protected applications such as Chrome, effectively elevating privileges and disclosing sensitive information.

Systems affected include devices running AppLockZ App Lock and Fingerprint Lock 4.2.11 on Android. No vendor or product version list was supplied beyond the specific application version, so any Android device using this version is considered vulnerable.

The vulnerability is local, requiring physical access. With a CVSS score of 2.4 and an EPSS score of < 1%, the risk assessment indicates low exploitation probability, but the absence of a KEV listing suggests no widespread exploitation reports yet. Nevertheless, the flaw’s nature allows immediate privilege escalation once bypassed. Attackers can exploit the flaw by traversing insecure navigation flows or intent‑based advertisement redirection, which the application treats as legitimate control paths.