CVE-2025-14021CWE-451

CVE-2025-14021

Medium · published December 15, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaScript within iframes while displaying trusted URLs, enabling phishing attacks through overlaid malicious content.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00212 · 10.9th percentile
Weakness
CWE-451 · User Interface (UI) Misrepresentation of Critical Information
Published
2025-12-15T12:15Z
Affected products (1)
ProductVersionsFixed in
linecorp/line< 14.14.014.14.0
References (1)
https://hackerone.com/reports/2548498 · [email protected]
EPSS history
Timeline
  • 15 DEC 06:41Z
    The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious…
    cvelistv5