CVE-2025-14021

State: Published
Severity: 4.3 Medium
Published: Dec 15, 2025
Updated: Dec 15, 2025
Reserved: Dec 4, 2025

Description

The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaScript within iframes while displaying trusted URLs, enabling phishing attacks through overlaid malicious content.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	LY-Corporation

Weaknesses

CWE-451 User Interface (UI) Misrepresentation of Critical Information

Affected Products

Product	Versions
LINE client for iOSLINE Corporation	14.13 to before 14.14Affected

References

https://hackerone.com/reports/2548498

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.