Executive brief
AppLockZ is an Android application used to protect other apps on a device with a PIN or fingerprint. A security flaw allows someone with physical access to the phone to bypass this lock by interacting with advertisements or browser links. This could allow an unauthorized person to access sensitive apps like Chrome or private messages even when they are supposed to be locked.
Technical details
The AppLockZ application (version 4.2.11) implements its security lock as a UI overlay rather than utilizing Android's secure authentication APIs. An attacker with physical access can exploit insecure navigation routes—specifically through advertisement or browser intents—to bypass the overlay. By navigating these cascading interface flows, the attacker can evade the lockscreen verification and gain access to protected applications (e.g., Chrome). This vulnerability is classified as an authentication bypass using an alternate path (CWE-288).
Affected products
- AppLockZ - TrustedApp App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11
Timeline
- 2026-05-26: disclosed: Vulnerability disclosed via NVD and GitHub repository.