CVE-2025-68710 affects Easyelife App lock (aka Fingerprint, Applock, or locker.app.safe.applocker) version 1.9.2 on Android. The vulnerability arises because the app lock is implemented as an overlay rather than using Android's secure authentication APIs. This design flaw allows a local attacker with physical access to bypass the PIN lock by exploiting insecure navigation through exposed routes such as advertisement or browser intents. The attacker can thus evade lockscreen verification and gain access to protected apps, resulting in limited information disclosure and privilege escalation. The CVSS v3.1 base score is 2.4, reflecting low severity with local attack vector and no user interaction required.

An attacker with physical access to a device running the vulnerable Easyelife App lock 1.9.2 can bypass the PIN lock and access protected applications like Chrome. This leads to limited information disclosure and privilege escalation on the device. The impact is considered low severity given the local access requirement and limited confidentiality impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the Easyelife App lock or using alternative app lock solutions that rely on Android's secure authentication APIs. Physical device security should be maintained to prevent unauthorized access.