LINE for Android CVE-2025-14019

Exploitation requires the victim to open an attacker-supplied link inside the LINE in-app browser on an affected Android client (versions 13.8 through 15.5), and the attacker's page must employ a specific layout that overlaps/obscures the full-screen warning prompt the browser normally shows. The attack is unauthenticated (PR:N) and network-delivered (AV:N) but is strictly limited by the need for user interaction (UI:R) - the user must open the malicious link AND be deceived into trusting the spoofed interface and entering data - and is confined to the affected version range; versions outside 13.8-15.5 and non-Android LINE clients are not indicated as affected. It is a deception-only flaw: no code execution, data read, or denial of service results directly from the bug.

This is a moderate-severity UI spoofing flaw (CWE-451) that signals a low operational priority despite affecting a very popular application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N, base 4.7) shows a network-delivered, low-complexity, unauthenticated attack but one that REQUIRES user interaction (UI:R) and yields only limited integrity impact with no confidentiality or availability impact - consistent with phishing/deception rather than code execution or data theft. The scope change (S:C) reflects that the in-app browser spoofing can influence trust decisions the user makes on attacker-controlled content. Exploitation-probability signals reinforce low urgency: EPSS is 0.18% (7th percentile), there is no CISA KEV listing (not actively exploited), and no SSVC/automatable data was provided. The sole reference is a HackerOne report (vendor bug-bounty disclosure via dl_cve@linecorp.com), which may contain reproduction detail but was not supplied as weaponized exploit code. Note one labeling tension: the 'Information Disclosure' tag does not align with the CVSS impact profile (C:N, I:L), which points to UI integrity/deception, not disclosure - this is a phishing-enablement bug, not a direct data-leak. Overall this is a legitimate but low-priority issue: high deployment footprint, but real-world exploitation depends on social-engineering success rather than a reliable technical primitive.

An attacker sends a LINE user a link to a malicious web page; when the victim opens it in the LINE in-app browser, the attacker's page uses a specific layout to obscure the full-screen security warning prompt so the user does not realize they are on an untrusted/spoofed page, and then enters credentials or sensitive data into the fake interface. The attack requires the victim to open the link and interact (UI:R), and no public exploit code was supplied - only a HackerOne disclosure report.