LINE for Android CVE-2025-14020

Exploitation requires the victim to open an attacker-controlled web page inside LINE for Android's in-app browser (version prior to 14.20), then navigate away to another application and return to LINE - the specific trigger is that the full-screen security Toast notification (which conveys security context such as the real origin) is not re-displayed on resume, leaving a window to present a spoofed interface. Limiting factors that reduce real-world risk: it is Android-only and version-bound (<14.20), it requires active user interaction (UI:R) in a specific app-switch-and-return sequence, it depends on social engineering to both open the link and act on the spoofed UI, and it yields only spoofing/credential-phishing potential (I:L) with no direct data access or code execution.

All signals converge on LOW real-world priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N = 4.3 Medium) is internally consistent with the description: the only impact is integrity-low (I:L) via UI spoofing, with no confidentiality or availability impact, and success hinges on user interaction (UI:R) plus social engineering. EPSS reinforces this - 0.18% probability at the 7th percentile indicates very low expected exploitation volume. The CVE is NOT on CISA KEV, so there is no evidence of active exploitation. No public exploit code is identified; the sole reference is a HackerOne disclosure report (coordinated, likely access-restricted), which is a disclosure artifact, not published weaponized code. The signals do not conflict: a low-severity phishing-aid bug with low EPSS, no KEV, and no public POC is a genuine low-priority item rather than a high-CVSS-but-low-risk anomaly. The main caveat is reach, not severity - LINE's enormous installed base means even a low-severity spoofing flaw has a large potential victim pool, so it warrants patching in the normal cycle rather than emergency remediation.

An attacker lures a LINE user into opening an attacker-controlled page in LINE's in-app browser, then the victim switches to another app (e.g., to retrieve a code) and returns to LINE. Because the full-screen security Toast fails to re-display on return, the attacker's page renders a spoofed login or trusted-interface overlay that the victim believes is legitimate and enters credentials or sensitive data. No public exploit code is identified at time of analysis; a HackerOne report exists but attack complexity is low once the victim is socially engineered into the interaction flow.