{"id":"CVE-2025-14021","state":"PUBLISHED","title":"The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaScript within iframes ","description":"The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaScript within iframes while displaying trusted URLs, enabling phishing attacks through overlaid malicious content.","publishedAt":"2025-12-15T06:41:37.992Z","updatedAt":"2025-12-15T15:49:07.716Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","source":"LY-Corporation"},"assigner":"LY-Corporation","products":["LINE Corporation LINE client for iOS"],"affected":[{"vendor":"LINE Corporation","product":"LINE client for iOS","versions":[{"version":"14.13","status":"affected","lessThan":"14.14","versionType":"custom"}]}],"references":["https://hackerone.com/reports/2548498"],"weaknesses":["CWE-451"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/14xxx/CVE-2025-14021.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-14021","state":"PUBLISHED","datePublished":"2025-12-15T06:41:37.992Z","dateUpdated":"2025-12-15T15:49:07.716Z","assignerShortName":"LY-Corporation","assignerOrgId":"657f3255-0560-4aed-82e4-7f579ec6acfb","dateReserved":"2025-12-04T11:44:56.068Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaScript within iframes while displaying trusted URLs, enabling phishing attacks through overlaid malicious content."}],"affected":[{"vendor":"LINE Corporation","product":"LINE client for iOS","versions":[{"version":"14.13","status":"affected","lessThan":"14.14","versionType":"custom"}]}],"references":[{"url":"https://hackerone.com/reports/2548498"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","exploitCodeMaturity":"NOT_DEFINED","remediationLevel":"NOT_DEFINED","reportConfidence":"NOT_DEFINED","temporalScore":4.3,"temporalSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NETWORK","modifiedAttackComplexity":"LOW","modifiedPrivilegesRequired":"NONE","modifiedUserInteraction":"REQUIRED","modifiedScope":"UNCHANGED","modifiedConfidentialityImpact":"NONE","modifiedIntegrityImpact":"LOW","modifiedAvailabilityImpact":"NONE","environmentalScore":4.3,"environmentalSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"na"}]}],"providerMetadata":{"shortName":"LY-Corporation","orgId":"657f3255-0560-4aed-82e4-7f579ec6acfb","dateUpdated":"2025-12-15T06:45:46.378Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-15T15:48:45.634591Z","id":"CVE-2025-14021","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-451","type":"CWE","lang":"en","description":"CWE-451 User Interface (UI) Misrepresentation of Critical Information"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-15T15:49:07.716Z"}}]}}}